Ninja Ads

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Ninja Ads bills itself as a CRM for WhatsApp Web, and version 7.4.3.87 with 24 users suggests a small project published by [email protected], a contact address rather than a company name. The first thing to note is a gap: the manifest data shows no host permissions and no API permissions. A content script that reorganizes WhatsApp chats has to be allowed to run on web.whatsapp.com, so that list went uncaptured rather than being genuinely empty.

The 22 network findings record connector use rather than destinations. They fire on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js (NET-JQUERY_AJAX), content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and 289149.js (NET-SOCKET_IO), and background.js:137 (NET-FETCH). A live socket plus fetch calls is how a real-time chat client syncs with a server. None of these findings names a destination host, and none touches a login page, a wallet or a bank.

Most of the endpoint list is extractor noise. Entries such as border.radius.circle, btn.glass, color.border.accent.orange and calls.function.arguments.delta are CSS tokens and JSON paths that a domain regex mistook for hosts. above.sm, below.sm, ae.jobs, af.pf and be.audio have the same shape: fragments of minified JavaScript. Two entries are real services. app.wascript.com fits a WhatsApp automation vendor's own backend, and api.statsigcdn.com is Statsig's feature-flag CDN. The Atlassian hosts (api.dev.atlassian.com, api.stg.atlassian.com) read as bundled library strings. None is an exfiltration endpoint.

The 754 code-smell findings and 407 indicators are what shipping a bundled front end looks like to a static scanner. On their own they describe JavaScript syntax. What carries weight is what is missing: zero malware signatures, zero secrets, zero tool-poisoning entries. The two obfuscation findings are OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. A base64 chunk inside a content-hashed asset file is normally an embedded font, image or worker blob, and indirect calls are how webpack resolves modules. Neither file carries a malware signature beside it, which is the pairing that would change this reading.

The strongest argument against treating this as scanner noise is the category itself. A WhatsApp CRM can read every message and contact a user has, and this one names an anonymous publisher and ships a large base64 blob in a directory called funnil. Fair points. What would settle them is a decode of that blob and the real host-permission list, and neither is in the evidence. Until then, the flagged behaviour is a socket connection to a chat backend, a fetch in background.js, and code-smell matches inside content/assets/js bundles. None of that describes harm.

Key Reasons

• Zero malware signatures, zero secrets and zero tool-poisoning entries across 1186 findings
• All 22 network findings are library connector patterns (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) in content/assets/js bundles and background.js, with no destination hosts named
• Endpoint list is dominated by CSS tokens and JSON paths misparsed as domains (border.radius.circle, btn.glass, calls.function.arguments.delta)
• Obfuscation limited to one base64 asset blob in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and an indirect call in a minified bundle, neither paired with a malware signature
• 754 code-smell matches are consistent with a bundled front-end rather than malicious behaviour

False Positive Considerations

• CSS property names and JSON paths (border.radius.circle, btn.glass, calls.function.arguments.delta) counted as network domains
• 754 code-smell findings generated by bundled/minified JavaScript
• Socket.IO, jQuery ajax and fetch connector matches in vendored content/assets/js files
• Large base64 blob inside a content-hashed bundle asset read as obfuscation

Reviewed 2026-10-11; recommended action: monitor; model confidence 70%.