WaListall | O Melhor CRM para WhatsApp Web – Teste Grátis

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WaListall is a CRM for WhatsApp Web: it organizes chats, tags contacts and keeps track of conversations for small businesses. The manifest declares no permissions and no host permissions, so its work happens in content scripts injected into the WhatsApp Web page rather than through privileged browser APIs.

The 22 network findings record which JavaScript APIs the code calls. NET-SOCKET_IO appears in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js, NET-JQUERY_AJAX in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, and NET-FETCH in background.js plus a dozen sibling bundles under content/assets/js/. Fetch, Socket.IO and jQuery Ajax are the ordinary transport layer for a tool that syncs chat and contact state with a server. Of the endpoints listed, app.wascript.com is the only one that reads like a real service, and it fits the product: a vendor backend for the CRM. The rest, including above.sm, be.audio, border.radius.circle, btn.glass and calls.function.arguments.delta, are CSS values and minified property chains that the extractor parsed as hostnames. One real domain says more than four hundred garbage ones.

The two obfuscation findings are OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Both files carry build hashes in their names and sit in directories full of sibling bundles, which is what production webpack or esbuild output looks like. A large base64 string in a bundle is usually an inlined image or an embedded config blob. Minification and bundling get labelled as obfuscation by pattern, and neither file has a malware signature next to it.

That absence is the strongest signal here. Across 1201 findings there are zero malware matches and zero malware-signature matches. What remains is 754 code-smell hits, which fire on fetch, exec and environment-variable references in any non-trivial script, and 422 IoC entries of the kind described above.

A skeptic would push back, and the pushback has weight. WaListall injects into WhatsApp Web, holds a live Socket.IO connection, and a CRM by definition ships customer chat data off the machine. If app.wascript.com were harvesting message contents, none of the evidence above would look any different. What keeps this from being ambiguous is the permission surface: no host permissions are declared beyond what the injected page context already allows, and no finding names cookie, token or credential access. Runtime capture of the Socket.IO payloads would settle what actually leaves the browser.

The publisher detail is thin: the developer contact is a generic address, [email protected], and the install base is 36 users. Whether app.wascript.com is a company you want holding your chat history is the decision a user is actually making.

Key Reasons

• Zero malware and zero malware-signature matches across 1201 findings; the volume is 754 code-smell hits and 422 extractor IoCs.
• All 22 network findings are API-usage pattern matches (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) in bundled content scripts, and no finding title names a destination host.
• The only endpoint that reads as a real service, app.wascript.com, matches the extension's stated CRM backend.
• Both obfuscation hits (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js) sit in hash-named bundle files with no malware signature alongside them.
• Manifest declares no permissions and no host permissions, and no finding reports cookie, token or credential access.

False Positive Considerations

• IoC extractor parsing CSS values and minified property chains (border.radius.circle, btn.glass, above.sm) as hostnames
• Code-smell rules firing on bundled production JavaScript (754 low-severity hits)
• Minified/hashed bundle files labelled as obfuscation
• Network rules matching ordinary Socket.IO, fetch and jQuery Ajax client-server transport

Reviewed 2026-10-12; recommended action: suppress false positive; model confidence 78%.