WhatsTime CRM for WhatsApp™ Web

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension shows 2638 total findings, but the nature of these findings reveals they are primarily false positives. The 1958 IoC findings are generated by the XIOC extractor, which is known to produce garbage from minified JavaScript—these do not represent actual suspicious domains. The network findings (25 total) in files like content/assets/js/v_7_4_2_13_59773d94-6a68-4ed1-8b86-dcf9791b0ab7200.js:1 and background.js:53 show generic fetch and socket_io calls, which are expected behavior for a CRM extension communicating with its backend service. The 654 code-smell findings are triggered by YARA rules that match basic Node.js patterns (postinstall_*, credential_*, etc.), not actual malicious code.

Crucially, there are zero malware signatures and zero obfuscation findings. The manifest finding MANIFEST-SENSITIVE-PERM-TABS in manifest.json is a medium-severity permission that is legitimate for a WhatsApp Web CRM tool that needs to interact with browser tabs. The extension's stated purpose (WhatsApp CRM functionality) aligns with its observed behavior (network communication, tab access).

The strongest counterargument would be the anonymous publisher (developer name is just [email protected]) combined with the low user count (71 users). However, an anonymous publisher alone does not constitute evidence of malicious intent. Many legitimate small businesses and developers publish extensions with email addresses rather than company names. Without specific suspicious domains, malware signatures, or obfuscation, the anonymous publisher is a risk factor but not a malicious indicator. The findings do not show credential theft, browser hijacking, or data exfiltration patterns—they show normal CRM functionality.

This extension requires no action beyond standard monitoring. If the extension gains significant users, runtime analysis would be warranted to verify the actual network destinations.

Key Reasons

• Zero malware signatures in 2638 total findings
• Zero obfuscation findings despite high finding count
• Network findings show generic fetch/socket_io patterns expected for CRM functionality
• IoC and code-smell findings match known false positive patterns from XIOC extractor and broad YARA rules

False Positive Considerations

• XIOC extractor garbage from minified JavaScript
• Code-smell YARA rules matching basic Node.js patterns
• Generic network findings without specific suspicious domains

Reviewed 2026-05-09; recommended action: no action; model confidence 75%.