WhaBoost CRM para WhatsApp

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The WhaBoost CRM extension presents 23 findings across network and obfuscation categories, with zero malware signatures, zero indicators of compromise, and zero code-smell matches. The network findings consist entirely of API usage detection: NET-JQUERY_AJAX, NET-SOCKET_IO, and NET-FETCH rules firing on files like content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js and background.js:137. These rules detect the presence of standard web libraries (jQuery, Socket.IO, fetch API) rather than suspicious network destinations. The extension declares no network_endpoints in its bundle, meaning no specific external domains were extracted from the code.

The two obfuscation findings are OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Base64 encoding and indirect function dispatch are standard techniques in bundled JavaScript. The file naming pattern (UUID-based filenames with version prefixes) is consistent with a build tool like webpack or esbuild outputting chunked assets. Without malware signatures co-located in these files, the obfuscation findings alone do not indicate malicious intent.

A skeptic would point out that the developer identity is a generic email address ([email protected]), the extension has only 109 users, and it declares no permissions despite claiming to integrate with WhatsApp. These are legitimate concerns. A WhatsApp CRM tool that cannot access WhatsApp's web interface would be non-functional, yet no host_permissions or permissions appear in the bundle. This could mean the extension relies on content scripts injected into web.whatsapp.com without declaring explicit permissions, or the permission data was not captured in this scan. The absence of permissions is unusual but does not constitute evidence of malicious behavior. The lack of malware signatures, the absence of any suspicious domains, and the entirely benign nature of the network findings (standard library detection) outweigh these concerns.

The extension is a small, Portuguese-language CRM tool for WhatsApp sales funnels. Its code structure shows standard web technology usage with no indicators of credential theft, data exfiltration, or browser hijacking. The findings are artifacts of automated scanning rules that flag common JavaScript patterns.

Key Reasons

• Zero malware signatures and zero indicators of compromise
• Network findings detect standard libraries (jQuery, Socket.IO, fetch) not suspicious endpoints
• No suspicious domains in network endpoints
• Obfuscation findings are consistent with bundled build tool output
• No code-smell or tool-poisoning findings

False Positive Considerations

• NET-JQUERY_AJAX and NET-SOCKET_IO rules fire on standard web library usage
• OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT match common bundled code patterns
• No actual suspicious domains extracted despite 22 network findings
• UUID-based filenames indicate build tool chunking not malicious obfuscation

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 85%.