BALTZ CRM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

BALTZ CRM is listed on the Chrome store as a CRM for WhatsApp Web, published by [email protected], with seven users. The code lines up with that description. background.js:137 calls fetch, and the bundles under content/assets/js/ produce NET-FETCH, NET-SOCKET_IO and NET-JQUERY_AJAX matches. Those three titles name the networking primitives in use: the fetch API, the socket.io client, and jQuery's AJAX wrapper. A CRM that reads a chat list and syncs it to a server carries all three.

The endpoint list is where the scanner's noise becomes obvious. It includes border.radius.circle, btn.glass and color.border.accent.orange, which are CSS design tokens, and calls.function.arguments.delta, a field name from a streamed API response. Then there are fragments like af.pf, ae.jobs and be.audio, the kind of string that falls out of minified JavaScript at a dot boundary. The Atlassian and Statsig hostnames (api.stg.atlassian.com, api.statsigcdn.com) are library URLs bundled into the package. None of the listed names is a credential-collection host, an anonymous proxy, or a hijacked search endpoint.

Two obfuscation findings exist: OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. A single large base64 block in a hashed, name-mangled bundle file is what embedded fonts, inline images or a packed vendor library look like. Indirect function calls are produced by every JavaScript minifier. Zero malware signatures matched anywhere in the package, and the 754 code-smell entries are the generic lint-class rules that fire on ordinary JavaScript.

The strongest counterargument is real: an extension that injects into WhatsApp Web, reads the DOM of private conversations and opens a socket to a server is the shape of a chat scraper. That is an active abuse category, and the manifest here declares no permissions and no host permissions, so there is no permission gate telling us what it can reach. What is missing is any destination. No finding names a host that would carry chat data to an unrelated operator, and the socket.io client found in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15 is not tied to a named endpoint in the evidence. That gap is what a runtime capture would settle, because it shows the actual connection target.

What remains is a seven-user extension from a reachable developer address whose findings come from bundled scripts and extractor artifacts rather than from behavior.

Key Reasons

• Zero malware signatures across the package (malware-signature: 0, malware: 0) despite 1186 total findings.
• All 22 network findings are API-pattern matches (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) inside content/assets/js bundles and background.js:137, consistent with a CRM syncing to its own backend.
• The network_endpoints list is dominated by non-network strings: border.radius.circle, btn.glass, color.border.accent.orange, calls.function.arguments.delta, af.pf, be.audio.
• The only two obfuscation hits are one LARGE_BASE64 blob in a hashed bundle asset and one FUNCTION_INDIRECT in a minified versioned bundle.
• 754 code-smell findings are generic lint-class rules, the documented noise floor for any non-trivial JavaScript package.

False Positive Considerations

• IoC extractor garbage: CSS tokens and streamed-response field names (border.radius.circle, btn.glass, color.border.accent.orange, calls.function.arguments.delta) reported as network endpoints.
• Code-smell volume: 754 low-severity rules fire on ordinary JavaScript and carry no behavioral signal.
• Bundled dependencies: minified vendor code in content/assets/js/ and funnil/assets/js/ produces NET-* and OBFUSCATION-* hits as a side effect of packaging.
• Network findings are API-usage detections (fetch, socket.io, jQuery AJAX) rather than matches against a suspicious destination domain.

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 74%.