Supply Chain Monitoring
Chrome updates extensions behind your back
The extension your team approved last month is not necessarily the extension running today. We re-run the full analysis pipeline on every version update, so you know when something changes.
Real incident: December 2024
A developer's Chrome Web Store account was compromised via a phishing email. The attacker pushed malicious updates to 35+ extensions in a single night - including Cyberhaven, with 400,000 enterprise users. The updates used the exact same permissions as the legitimate versions. Every permission-based scanner showed no change. Chrome auto-updated the extensions on employee devices within hours.
The only way to catch this is to re-analyze the code on every update - which is what we do.
How it works
Update detection
We run scraping infrastructure across the Chrome Web Store to detect new extension versions. When a new version is published, it enters the analysis pipeline automatically - target SLO: ingestion within 2 hours of publication, p95.
Full pipeline re-run
The new version goes through the same analysis as the original - deobfuscation, static claim formation, dynamic sandbox execution, network capture, evidence collection, and claim verification. Not a diff of the source. A full independent analysis of what the new version does.
Comparison against prior version
The new analysis is compared against the previous version's results. If the new version earns a finding at a severity your policy alerts or blocks on, every fleet running it gets a threat in the dashboard and an alert on your notification channels.
What triggers an alert
- Malware or vulnerabilities found in a new version that wasn't in the previous one
- A new version rated at a severity your policy alerts or blocks on
Know when a trusted extension turns malicious.
Free for up to 20 devices. Results within the hour.