Quickly detect and eliminate risks in any software your teams rely on - extensions, packages, apps, and models.
JetBrains Marketplace
Chrome Web Store
Edge Add-ons
Firefox Add-ons
Cursor
Windsurf
npm
PyPi
Hugging Face
MCP
Office Add-ins
Homebrew
Visual StudioJetBrains MarketplaceChrome Web StoreEdge Add-onsFirefox Add-onsCursor
Amazon's AI coding assistant was quietly programmed to delete your files, wipe your cloud resources, and destroy your development environment through a malicious VS Code extension. The attack vector? A simple GitHub pull request that no one caught until it was too late.
One threat actor. Two major marketplaces. Nearly 3 million installs. The numbers may have been faked — but the backdoors they dropped were very real.
Our investigation of a single "verified" color picker exposed a coordinated campaign of 18 malicious extensions that infected a massive 2.3 million users across Chrome and Edge.
We discovered a critical vulnerability in open-vsx.org, the open-source VS Code extensions marketplace powering popular VSCode forks like Cursor, Windsurf and VSCodium, used by over 10,000,000 developers
We don't guess, we analyze what software is actually made of. Extensive, agentic risk analysis that sees past labels to real composition and behavior.
Track and manage every piece of software the moment it enters your ecosystem.
