Lightiius CRM

AI Security Review

Evidence context: threat category none; evidence quality strong.

The Lightiius CRM extension converts WhatsApp Web into a professional CRM for sales teams. The evidence bundle contains 21 medium-severity findings, all network-related detections. These include NET-FETCH-background.js-17, NET-FETCH-background.js-28, and NET-FETCH-background.js-136 in the background script, plus multiple NET-SOCKET_IO and NET-FETCH findings in content scripts under content/assets/js/ (e.g., v_7_4_3_31_3bb7ccc9-19a6-4120-bc11-61c531f17fc3120.js:37). Additionally, NET-JQUERY_AJAX-crm/assets/js/a56befbe-dc0f-4060-9944-0c49bb0bdad8.BOUJIqqs.js-1 and NET-FETCH-funnil/index.js-1 are present. The manifest analysis finding MANIFEST-SENSITIVE-PERM-TABS in manifest.json is expected for an extension that needs to interact with WhatsApp Web tabs.

These findings are generic detections of network activity, not evidence of malicious behavior. The network findings do not reveal any suspicious domains—they simply detect that fetch, socket_io, and jquery_ajax calls exist. For a cloud-based CRM extension, network connectivity to a backend server is required functionality. The tabs permission is necessary for the extension to interact with WhatsApp Web pages as described in the extension's purpose.

The strongest counterargument is the anonymous developer identity ([email protected]) and low user count (33 users). An email address as the developer name is less trustworthy than a verified company, and the low adoption could indicate a new or niche product. However, these factors alone do not constitute evidence of malicious behavior. The critical security indicators are absent: there are 0 malware signatures, 0 obfuscation findings, 0 code-smell findings, and 0 suspicious IoC domains in the findings summary. The network behavior is consistent with legitimate CRM functionality—syncing customer data, managing contacts, and communicating with a backend service.

The findings summary explicitly shows "ioc":"0","malware-signature":"0","malware":"0" with only "network":"20" detections. This clean profile, combined with the expected use case for a WhatsApp CRM, indicates the findings are false positives driven by the XIOC extractor's generic network call detection rather than actual malicious activity. The extension requires no action beyond standard monitoring.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• Network findings are generic detections without suspicious domains
• Tabs permission is legitimate for WhatsApp CRM use case
• No code-smell findings indicating YARA noise
• Extension behavior matches stated purpose

False Positive Considerations

• Generic network call detections without suspicious domains
• Tabs permission expected for WhatsApp Web interaction
• No malware signatures or obfuscation findings
• No code-smell or IoC findings beyond network activity

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 85%.