WaSeller - Perder vendas no WhatsApp não é normal

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WaSeller is a WhatsApp Web CRM extension with 100,000 users, published by [email protected]. The extension's stated purpose is to organize customer service and optimize sales through WhatsApp Web, which explains its technical architecture.

The 22 network findings all reference standard web APIs: jQuery AJAX calls in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, Socket.IO connections in multiple files like v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js, and fetch calls in background.js:137 and several content scripts. For a CRM tool that needs real-time messaging integration with WhatsApp Web, Socket.IO for WebSocket connections and fetch/jQuery for API calls are expected. A skeptic might argue that the volume of network findings indicates excessive data transmission, but the findings show only the presence of standard APIs, not suspicious destinations or data exfiltration patterns. No malicious domains, credential harvesting endpoints, or unknown external services appear in the network findings.

The two obfuscation findings require context. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js references a file in a "funnil" directory, which typically contains marketing or analytics scripts bundled from third-party sources. Large base64 strings in bundled dependencies are common. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js likely reflects minified or transpiled code rather than intentional obfuscation. Modern JavaScript build tools produce code patterns that trigger these rules. Neither finding shows malware signatures or suspicious payload delivery.

The extension declares no host permissions or special permissions in the manifest, which limits its capability to access sensitive data beyond WhatsApp Web's own interface. The developer is identifiable, the extension has substantial user adoption, and the code structure matches a legitimate SaaS product integrating with WhatsApp's web interface. Zero malware signatures matched, zero IoCs flagged suspicious domains, and zero credential theft indicators appeared. The findings are entirely explainable as normal web application behavior triggering automated detection rules.

Key Reasons

• Network findings show only standard web APIs (jQuery, Socket.IO, Fetch) with no suspicious destinations
• Obfuscation findings reflect minified code and bundled third-party scripts, not malicious obfuscation
• Zero malware signatures, zero IoCs, and zero credential theft indicators detected
• Extension has identifiable developer, 100,000 users, and legitimate business purpose
• No host permissions declared, limiting capability to access sensitive data

False Positive Considerations

• Standard web API usage (jQuery, Socket.IO, Fetch) triggering network findings
• Minified/bundled JavaScript triggering obfuscation rules
• Third-party marketing scripts in funnil directory containing base64 data
• No actual malicious domains, malware signatures, or credential theft indicators present

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 82%.