FocusLead

AI Security Review

Evidence context: threat category none; evidence quality moderate.

FocusLead is a Chrome extension that adds CRM features to WhatsApp Web, organizing chats and tracking leads. The shipped code is a versioned build under content/assets/js/ (files named v_7_4_3_87_0a650f0a-...js) plus a second folder named funnil. Across 1,189 findings, nothing matched a malware family signature and nothing was rated high or critical. That single fact sets the ceiling on how alarmed anyone should be.

The 22 network findings are library detections. NET-SOCKET_IO-content/assets/js/...d28912.js:15 and NET-SOCKET_IO-...d28966.js:1 mean the build includes Socket.IO, the standard way a chat tool receives live message updates. NET-JQUERY_AJAX-content/assets/js/...d28923.js:1 is jQuery's request helper. NET-FETCH-background.js:137 shows the service worker issuing a fetch. A CRM that mirrors WhatsApp conversations needs all of these. None of the findings names a destination, so there is no exfiltration claim to make.

The endpoint list shows how much of the extracted domain volume is garbage. Entries such as border.radius.circle, btn.glass, color.border.accent.orange and calls.function.arguments.delta are CSS token names and JavaScript property chains read as hostnames. ae.jobs, af.pf, be.audio and artboard.phone are country-code strings. The genuine services in the list are api.statsigcdn.com, a feature-flag and analytics CDN used across the web, the api.dev.atlassian.com entries that come from a bundled integration library, and app.wascript.com, which reads as this product's own backend.

The 754 code-smell findings and the two obfuscation flags follow the same pattern. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/...d289260.js:1 describes indirect function calls, standard output for any bundler. OBFUSCATION-LARGE_BASE64-funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1 is a base64 block, and it is the one item here whose contents we could not inspect. Base64 in a bundled asset is usually an inlined image or font.

A skeptic has a fair point: a WhatsApp Web CRM can read every message in the account, it is published under a bare email address ([email protected]), and it has 34 users. That is a real category risk, and it describes what the extension is built to do. The same goes for the manifest reading as having no permissions and no host permissions, which is strange for something that must run on web.whatsapp.com. That gap looks like a parsing miss rather than a hidden capability, and it is the main reason our confidence is not higher.

The verdict follows from what the findings actually are. Library plumbing, minifier artifacts and design tokens account for all of them. A re-run plus a look inside funnil's base64 blob would close the remaining gap.

Key Reasons

• Zero malware and zero malware-signature matches across 1,189 findings; every severity is medium or low.
• The 22 network findings are library detections (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) inside minified files under content/assets/js/, and none names a suspicious destination domain.
• The 410 IoCs are dominated by extractor artifacts: CSS design tokens such as border.radius.circle and btn.glass, and property chains such as calls.function.arguments.delta.
• The two obfuscation flags sit in minified bundle output; FUNCTION_INDIRECT is a routine bundler artifact and LARGE_BASE64 is a base64 asset in funnil/.
• Real endpoints in the list resolve to a feature-flag CDN (api.statsigcdn.com), a bundled Atlassian integration library, and the product's own backend at app.wascript.com.

False Positive Considerations

• IoC extractor read CSS design tokens and JavaScript property chains as hostnames
• 754 code-smell matches generated by minified vendor bundles
• Network findings are library-fingerprint detections (Socket.IO, jQuery AJAX, fetch) with no destination attached
• Obfuscation flags fired on standard bundler output

Reviewed 2026-10-10; recommended action: monitor; model confidence 73%.