Vende+

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Vende+ is a Chrome extension that layers CRM features onto WhatsApp Web: tagging chats, tracking follow-ups, and keeping a shared contact list. The shipped code is a bundled build under content/assets/js/, with hashed filenames like v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js.

Across 1,210 recorded findings there are zero malware signatures, zero leaked secrets, and zero tool-poisoning hits. Everything the scanner flagged falls into three groups, and each group traces back to how the extension is built.

The 22 network findings are library-pattern detections. NET-SOCKET_IO fires in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28966.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js, NET-FETCH fires in background.js:137 and in most of the content script bundles, and NET-JQUERY_AJAX fires in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js. A CRM that keeps a WhatsApp inbox in sync needs a persistent channel to its backend, which is what Socket.IO provides, plus ordinary fetch calls for the REST side. These titles describe transport, not a target.

The obfuscation bucket holds two items. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js is the shape a bundled stylesheet or inlined image takes when a data URI is base64 encoded. OBFUSCATION-FUNCTION_INDIRECT in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js is what minified JavaScript looks like after a bundler wraps its exports. Neither file pairs that output with a malware signature.

The IoC list is the clearest noise. It includes border.radius.circle, btn.glass and color.border.accent.orange, which are CSS design tokens, plus calls.function.arguments.delta, a streaming API event name. api.dev.atlassian.com and api.atlassian-us-gov-mod.com come from an Atlassian design system library compiled into the build. api.statsigcdn.com is a feature-flag service. The captured manifest lists no host permissions and no API permissions, which reads as a parsing gap rather than a real absence of access for an extension running content scripts on WhatsApp Web.

A skeptic has a fair case. The publisher address is a generic [email protected] rather than a company domain, the install base is 12 users, and app.wascript.com is a backend that receives data from a content script able to read WhatsApp conversations. That last point is the real question: a WhatsApp CRM reads messages by design, so the trust decision is about where that data goes. The evidence shows no credential-theft indicators against login domains, no cookie extraction, no hidden payload, and no hostname that reads as exfiltration infrastructure. app.wascript.com is the extension's own service endpoint, which is where a CRM's data would go. What would settle the remaining doubt is a published privacy policy naming wascript.com as the processor, which this bundle does not contain.

Key Reasons

• Zero malware-signature, malware, secret and tool-poisoning matches across 1,210 findings; only generic transport detections (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) inside bundled content/assets/js files.
• The IoC set is extractor noise: design tokens such as border.radius.circle and btn.glass, the event name calls.function.arguments.delta, and Atlassian design-system hostnames.
• Obfuscation hits (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, OBFUSCATION-FUNCTION_INDIRECT in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js) match minified/bundled output, not payload hiding.
• Socket.IO and fetch usage matches the stated function of keeping a WhatsApp Web inbox in sync, so behavior and description agree.

False Positive Considerations

• IoC extractor misreading CSS design tokens and API event names as domains
• 754 code-smell findings inside a minified content script bundle
• Obfuscation rules firing on standard bundler output (base64 data URIs, indirect function wrapping)
• Third-party design-system and analytics hostnames (Atlassian, Statsig) compiled into the build

Reviewed 2026-10-12; recommended action: suppress false positive; model confidence 72%.