Wa Elo IA

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Wa Elo IA version 7.4.3.87 (99 users) adds a CRM layer on top of WhatsApp Web: chat labels, quick replies, lead tracking. The bundle splits into content scripts under content/assets/js/ and a background.js service worker. The manifest declares no permissions and no host_permissions entries, so whatever the extension touches inside WhatsApp Web runs through content scripts on pages it already matches.

What the findings show

Nothing here reads as malware. No finding carries a malware signature or a malware family match, and nothing reaches high or critical severity. The 22 network findings are library patterns: NET-JQUERY_AJAX, NET-SOCKET_IO and NET-FETCH spread across files like content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and background.js:137. Socket.io plus fetch calls fit a tool that mirrors a live chat inbox.

The two obfuscation findings, OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js, match hashed vendor chunks and webpack output. A large base64 blob inside a file named with a build hash usually carries fonts, icons or inlined images. Function indirection shows up in every minified bundle that ships.

The other 1,178 matches are 754 code-smell hits and 424 IoCs, both well-documented noise categories. The endpoint extractor proves the point: "border.radius.circle", "btn.glass" and "calls.function.arguments.delta" are string literals lifted from CSS design tokens and TypeScript type definitions. They resolve nowhere. Two hosts do look genuine, app.wascript.com and api.statsigcdn.com, which match a vendor backend and a feature-flag service. The Atlassian API subdomains come from a bundled component library.

The counterargument

A skeptic would say the product model carries the risk: a WhatsApp Web CRM reads message content and ships it to app.wascript.com, and the publisher behind "[email protected]" attaches no company name. That concern deserves an answer, and the answer sits outside this scan. What the scan can state is what it did not find. No malware signature matched. No hardcoded secret turned up. No credential-harvesting pattern and no endpoint pointing at a login domain or an unrecognised host appeared. Every network call maps to the chat-sync job the listing advertises. A capture showing message data leaving for anything other than app.wascript.com would change this verdict, and nothing in the reviewed files points that way.

Key Reasons

• No malware-signature, malware, secret or tool-poisoning findings across 1,203 matches, and no high or critical severity
• Every network finding is NET-JQUERY_AJAX, NET-SOCKET_IO or NET-FETCH inside bundled content scripts and background.js:137, matching the chat-sync job of a WhatsApp CRM
• Real endpoints (app.wascript.com, api.statsigcdn.com) belong to the vendor backend and a feature-flag service
• IoCs include CSS design tokens and TypeScript property names (border.radius.circle, btn.glass, calls.function.arguments.delta) misread as domains

False Positive Considerations

• IoC extractor read CSS and TypeScript property names (border.radius.circle, btn.glass, color.border.accent.orange) as domains
• 754 code-smell matches from broad rules that fire on any non-trivial bundled JavaScript
• OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT match hashed webpack vendor chunks
• Network findings count library usage (jQuery, socket.io, fetch) rather than any specific suspicious host

Reviewed 2026-10-12; recommended action: no action; model confidence 78%.