IA do Corretor

AI Security Review

Evidence context: threat category none; evidence quality strong.

The extension "IA do Corretor" presents a massive volume of automated scanner alerts, totaling 1172 findings. A close look at the extracted network endpoints reveals the primary driver of this noise. The scanner flagged strings like border.radius.circle, color.border.accent.orange, and calls.function.arguments.delta as suspicious domains. These are not network destinations. They are CSS design tokens and abstract syntax tree property chains extracted from bundled frontend libraries. The XIOC extractor routinely misidentifies these frontend framework artifacts as command-and-control infrastructure.

The 21 network findings point to standard web communication patterns. Files like content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf692021.js trigger jQuery AJAX and Socket.IO connection alerts. The Socket.IO connections in files like v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf692012.js establish persistent channels for live updates. A customer relationship management tool requires real-time data synchronization and API calls to function. The two obfuscation alerts, specifically OBFUSCATION-LARGE_BASE64 in funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js and OBFUSCATION-FUNCTION_INDIRECT in the content scripts, reflect standard webpack or rollup bundling behavior. Base64 strings in asset folders typically encode inline images or fonts, while indirect function calls are a hallmark of minified module loaders.

The extension declares zero host permissions and zero API permissions in its manifest. It operates without the ability to read browsing history, intercept network traffic across arbitrary sites, or access cookies. The developer is listed as [email protected], and the tool claims to be a CRM for the Chrome browser. With no malware signatures matching and no credential theft indicators, the code simply executes standard frontend logic. The presence of Atlassian domains like api.atlassian-us-gov-mod.com in the endpoint list further confirms the inclusion of third-party UI components rather than malicious routing.

A skeptic might point to the 418 indicators of compromise and argue that the sheer volume of alerts warrants immediate removal. They would note that a CRM extension handling sensitive customer data should be held to a strict standard, and any unexplained network traffic to app.wascript.com warrants suspicion. However, the volume of alerts is an artifact of the scanning methodology, not a reflection of the code's behavior. The specific domains flagged are mathematically impossible to be real network endpoints, and the actual network calls route to standard Atlassian infrastructure and the developer's own API. We must separate the scanner's inability to parse modern JavaScript bundles from the actual threat posture of the extension. The risk score is inflated by bundled dependencies, a known scanner bias that punishes complex applications for including standard open-source libraries.

Key Reasons

• 418 IoC findings are CSS design tokens and AST property chains misidentified as domains
• Zero host or API permissions declared in the manifest
• Network findings map to standard Socket.IO and jQuery AJAX calls
• Obfuscation alerts point to base64 encoded assets and standard bundler output
• Zero malware signatures or credential theft indicators detected

False Positive Considerations

• IoC extractor misidentifying CSS design tokens as domains
• Property access chains parsed as network endpoints
• Bundled frontend libraries triggering code-smell and obfuscation rules

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 85%.