D2CHATPRO

AI Security Review

Evidence context: threat category none; evidence quality moderate.

D2CHATPRO presents itself as a CRM for WhatsApp Web, published under [email protected] at version 7.4.3.87, with 14 users on the Chrome Web Store. The scan covers 779 findings. Only 25 reach medium severity, and every one of those is a behavior detection rather than a payload detection. There are zero malware signature matches, zero indicator-of-compromise matches, zero exposed secrets and zero tool-poisoning hits in the package.

The network findings are labels for JavaScript API usage inside bundled library files. NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js-15 and four more NET-SOCKET_IO hits flag a socket.io client, the standard library for a persistent connection. NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js-13 flags a jQuery ajax call. NET-FETCH-background.js-137 flags window.fetch inside the service worker. A tool that keeps a WhatsApp chat list in sync in real time needs all three of those. Not one of the 22 network findings records a hostname, which is the detail that would matter if chat data were being shipped somewhere.

The two obfuscation matches fit the same pattern. OBFUSCATION-LARGE_BASE64-funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js-1 fires on an embedded blob, which in a vendor bundle is normally an image, a font or a source map. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js-1 fires on indirect calls, which is how minifiers emit function tables. Neither sits in the same file as a decoder stub, a loader or a suspicious endpoint.

A skeptic would push back on the extension's purpose. A WhatsApp Web CRM reads every message the user sends and receives, and a socket.io connection means there is a server on the other end of a live channel. If someone wanted to harvest conversations, this is the shape the code would take. That argument describes capability, not observed behavior. Nothing in the bundle reads cookies, touches a login domain or names a destination host, and the scan found no credential, secret or exfiltration match. The claim that needs evidence is the destination URL for the socket and the content script match patterns in the manifest. The scan records one manifest-analysis finding and no permission list, so those answers are not in front of us.

What the tool did catch is volume. 754 of the 779 findings are low-severity code-quality matches spread across hashed vendor files, the expected output of running style rules over a minified bundle. Strip those and the medium-severity set is library API usage plus two minification artifacts.

Key Reasons

• Zero malware-signature, IoC, secret or tool-poisoning matches across 779 findings.
• All 22 network findings are library API detections (socket.io, jQuery ajax, fetch) with no hostname recorded.
• 754 of 779 findings are low-severity code-quality matches in hashed minified bundle files.
• Obfuscation flags are LARGE_BASE64 and FUNCTION_INDIRECT inside bundled assets, both typical of minified vendor code.
• No permission list or content script match patterns available, leaving the socket.io destination unverified.

False Positive Considerations

• Code-quality and code-smell rules firing on minified bundled JavaScript, producing 754 low-severity findings
• Library usage detectors (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) counted as network findings with no hostnames
• LARGE_BASE64 match on an embedded asset blob in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js read as obfuscation
• FUNCTION_INDIRECT match on minified output in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js

Reviewed 2026-10-12; recommended action: monitor; model confidence 75%.