Nextgo Zap: Seu Whatsapp Turbinado!

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Nextgo Zap is a Chrome extension that adds CRM features to WhatsApp Web: chat organisation and business tooling for 462 users. Version 7.4.3.87 ships a background.js service worker and a large content/assets/js/ bundle whose filenames carry build hashes (v_7_4_3_87_0a650f0a-...).

What the scan recorded is 23 medium-severity items. Twenty-two are network detections with titles like NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-...8912.js-15, NET-JQUERY_AJAX-content/assets/js/...8923.js-1 and NET-FETCH-background.js-137. Those titles name the JavaScript library that made the call rather than the host it contacted. Socket.IO is a websocket library used for real-time updates, jQuery's AJAX wrapper and the fetch API are how any web client talks to a server, and a WhatsApp CRM needs a live connection to receive new messages plus a REST call to persist contacts. The pattern matches the stated purpose. No finding names a suspicious host, and the package records no network endpoints at all, so the scanner flagged calls without resolving destinations.

Alongside those, the package produced zero malware signatures, zero indicators of compromise, zero credential-harvesting patterns and zero secrets. Nothing in the code targets login or banking domains. The publisher is [email protected], a store-handle email rather than a company name, which is common for small Brazilian extension shops and is not on its own a reason for alarm.

The two obfuscation flags are OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_...8260.js. The second fires on minified output; indirect function references are what a bundler emits when it renames symbols. The first reports an embedded base64 block, which in a hashed build asset is typically an inlined image, font or vendor data. Neither is a malware signature. One manifest-analysis item was counted but not listed among the findings, and the permission arrays came back empty even though the extension injects content scripts, so the declared permission scope could not be read from this package.

The strongest counterargument concerns funnil/assets/js/9cf42769-...CgnacD38.js. A large base64 payload in a directory that no public feature description mentions is worth a closer look, and the scan did not decode it. A skeptic would argue that blob could hold an encoded script or a list of exfiltration targets. That gap is real. It is also not evidence of harm, and everything the scan resolved points away from it: no malware signature matched anywhere in the package, no indicator was extracted, and the network detections sit in ordinary library code rather than in hand-written request builders with hardcoded hosts. Decoding that single file, or a short runtime session, would close the question.

Key Reasons

• All 22 network findings are library-usage detections (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) in hashed build assets and background.js, consistent with a WhatsApp Web CRM client
• Zero malware signatures, zero IoCs, zero secret findings and no suspicious destination domain anywhere in the package
• OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/...8260.js matches minified bundler output, not deliberate hiding
• Publisher is a Brazilian extension store handle, with no impersonation of a known brand in the name or description

False Positive Considerations

• Framework-usage network detections (Socket.IO, jQuery AJAX, fetch) reported as medium findings in bundled JavaScript
• Minified build output triggering FUNCTION_INDIRECT obfuscation detection
• LARGE_BASE64 detection on an embedded asset inside a hashed bundle file
• Permission and endpoint arrays empty, so severity rests on code patterns rather than resolved destinations

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 72%.