Whapro – Automação, CRM e Vendas no WhatsApp Web

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension bills itself as a WhatsApp Web CRM: conversation organization, canned replies, sales tracking. Its code is a bundled front end under content/assets/js/ with a service worker at background.js. Across 1,184 findings on version 7.4.3.86 the scan recorded zero malware matches and zero malware signatures, and nothing rated critical or high. The volume comes from 754 code-smell hits and 405 indicator-of-compromise entries, both categories that fire on any large JavaScript bundle.

The 22 network findings describe API shapes. NET-SOCKET_IO-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js-15 and four sibling Socket.IO detections mark a persistent connection, which is what a shared inbox needs to stay in sync. NET-FETCH-background.js-137 and the NET-JQUERY_AJAX hits mark ordinary HTTP calls. No entry names a login page, a payment provider or a bank, which is where credential-stealing extensions show up.

The endpoint list behind those hits is mostly parser debris. above.sm, below.sm, border.radius.circle, btn.glass, artboard.phone and calls.function.arguments.delta are CSS values and property chains the extractor read as hosts. The entries that resolve belong to the vendor's own service, app.wascript.com, and to libraries bundled into the app: api.statsigcdn.com, api.atlassian.com and atlassian-isolated.net. Statsig is a feature-flag service and the Atlassian hosts come from a shipped SDK, so neither is a destination the extension invented.

Two obfuscation findings deserve a direct look. OBFUSCATION-LARGE_BASE64-funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js-1 flags an embedded base64 block inside a hashed chunk. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js-1 flags indirect calls in another chunk. Both are what a minifier produces, and neither file carries a malware match beside it, which is the pairing that would change this assessment. The manifest analysis returned a single finding, and no host permissions or permissions are listed for the extension, so nothing in the evidence shows broad browser access being requested.

A skeptic would answer that the publisher is listed only as an email address, that WhatsApp automation requires reading every message rendered in the page, and that a Socket.IO channel could carry that content anywhere. That concern is real, and the scan cannot settle it, because the finding records the connection library and not the destination or the payload. What the scan can say is that the only named vendor endpoint, app.wascript.com, matches the CRM service the store listing advertises, and that no finding shows chat content leaving the page. Someone deciding whether to trust a WhatsApp automation vendor with their messages is making a judgment this code review cannot make for them.

The rest is scanner behavior. jQuery ajax calls, fetch calls and socket connections each generate their own entry when they appear in a bundled library, and a chat automation tool ships a lot of libraries.

Key Reasons

• Zero malware and zero malware-signature matches across 1,184 findings, with no critical or high severity items.
• Network findings are detector patterns (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) with no suspicious destination; named hosts are the vendor service app.wascript.com and bundled library endpoints.
• IoC list is dominated by parser debris such as border.radius.circle, btn.glass and calls.function.arguments.delta.
• Both obfuscation hits (LARGE_BASE64, FUNCTION_INDIRECT) fall inside hashed bundle chunks with no malware match in the same file.
• Declared behavior of a live-sync WhatsApp CRM accounts for the Socket.IO channels and fetch calls, and no credential, banking or search-hijack domains appear.

False Positive Considerations

• IoC extractor reading CSS values and property chains as domain names
• Code-smell YARA rules firing on bundled and minified JavaScript
• Socket.IO, fetch and jQuery AJAX pattern matches inside shipped libraries
• Base64 asset blocks and minifier output inside hashed webpack chunks

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 72%.