waSuper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

waSuper is a CRM overlay for WhatsApp Web, scanned here at version 7.4.3.87 with six listed users. The bundle records no permissions and no host permissions, and the only endpoint that belongs to the product itself is app.wascript.com. Everything else in the network list is either a bundled library host or a string the extractor misread.

The 1184 findings split into groups that CVEQ generates on any bundled JavaScript. 754 are code-smell matches and 405 are indicator-of-compromise strings. Neither carries a malware signature, and the malware-signature, malware, secret and tool-poisoning counts are all zero. A single manifest-analysis finding appears alongside no permission entries, so the extension runs through content scripts rather than declared APIs.

Look at the network findings. All 22 are library API detections. NET-JQUERY_AJAX fires at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js:1 and :13. NET-SOCKET_IO fires at the same family of files, including v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js:64 and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289175.js:37. NET-FETCH fires at background.js:137. Those titles describe APIs, not destinations: jQuery's ajax helper, a socket.io client and fetch() are ordinary web application code, and a socket.io link to a CRM backend is how conversation state stays in sync with app.wascript.com.

The endpoint list reads as alarming by volume and is largely not a domain list. Entries such as border.radius.circle, calls.function.arguments.delta, color.border.accent.orange, btn.glass and avatar.online are CSS custom property names and JavaScript property chains parsed as hostnames. The genuinely real hosts, app.wascript.com, api.statsigcdn.com and api.atlassian.com, belong to the extension's own service plus feature-flag and UI libraries it bundles.

Two obfuscation hits land on build output. OBFUSCATION-LARGE_BASE64 points at funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1, a single line holding an embedded asset blob. OBFUSCATION-FUNCTION_INDIRECT at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1 matches the way minifiers route calls through lookup tables. Neither hides a payload that the scanner could not read.

A skeptic would aim at the publisher rather than the code. The developer field is an email address, [email protected], not a company, and six users is no track record. An extension that reads WhatsApp Web and opens a socket to a vendor backend has exactly the shape of a chat-scraping tool, and that is a fair description of the capability. It is not evidence of misuse. What would change the picture is a manifest requesting broad host access, a socket connection to a host other than app.wascript.com, or a malware signature anywhere in the 1184 findings. None of those is present. An extension can only be judged on the code in front of us, and this code is a minified front-end bundle doing front-end bundle things.

Key Reasons

• Zero malware signatures across 1184 findings; malware-signature, malware, secret and tool-poisoning categories are all empty
• All 22 network findings are library API detections (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) inside bundled content/assets/js files, not destinations
• The 405-item IoC list is dominated by CSS token names and JS property chains (border.radius.circle, calls.function.arguments.delta), not real hosts
• Both obfuscation hits (LARGE_BASE64, FUNCTION_INDIRECT) land on single-line bundle files in funnil/assets/js/ and content/assets/js/
• The only product-owned endpoint is app.wascript.com; the remaining real hosts belong to bundled libraries (api.statsigcdn.com, api.atlassian.com)

False Positive Considerations

• 754 code-smell matches from minified bundled JavaScript (code-quality and credential-style rules firing on library code)
• 405 IoC strings that are CSS custom property names and JavaScript property access chains parsed as hostnames
• Network findings are library API presence detections in content/assets/js bundle files, not outbound destinations
• Obfuscation flags firing on minified build output (embedded base64 asset blob and indirect function calls)

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 74%.