Zaply Seller

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Zaply Seller is a Portuguese-language CRM for WhatsApp Web, published on the Chrome Web Store with 10 users at version 7.4.3.84 and developer contact [email protected]. The scan produced 1,154 findings, and the shape of them matters more than the total: zero malware signatures, zero malware family matches, zero hardcoded secrets, zero dependency alerts and zero tool-poisoning hits. What remains is 727 code-smell entries and 403 indicator extractions, both of which are the noise floor for any extension that ships a bundled front end.

The functional core shows up in the network findings. background.js lines 52, 63 and 137 make fetch calls, and content scripts such as content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js open socket.io connections, with jQuery AJAX helpers alongside them in ...121.js, ...122.js and ...146.js. A CRM that organizes WhatsApp conversations needs a persistent channel to a server, so this pattern describes the advertised product. Nothing in the findings shows a cookie API call, a credential read, or a form grab against a login page.

The endpoint list is where the extraction pass goes wrong. Entries such as color.text.accent.orange, color.border.accent.orange, border.radius.circle, btn.glass, above.sm, calls.function.arguments.delta and artboard.phone are CSS class names, design tokens and clipped property chains. The legitimate-looking infrastructure in the same list (api.statsigcdn.com, api.dev.atlassian.com, atlassian-isolated.net) is a feature-flag SDK and an Atlassian design system bundled into the build. Those tokens and hosts arrive together in the same package, which points at a dependency rather than Zaply's backend.

The two obfuscation entries follow the same pattern. OBFUSCATION-FUNCTION_INDIRECT points at content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js:1, and OBFUSCATION-LARGE_BASE64 points at funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js:1. Both file names carry a version string or a content hash, which is what webpack and Vite emit. Indirect function calls are a normal artifact of minification, and large base64 payloads inside built chunks are usually embedded icons, fonts or images. The indicator that would matter is a malware signature sitting in the same file as the obfuscation, and the scan reports none.

A skeptic would push back on one point: this extension reads every WhatsApp conversation its users have and forwards them over socket.io, so the privacy exposure is real regardless of what the scanner matched. That is a fair reading of the product. It is also an argument about the business model, and the evidence contains no artifact of anything beyond it: no exfiltration rule, no credential-themed finding, and no unexplained remote host that would receive the messages. The verdict rests on that absence.

What would change it: a malware signature co-located with the base64 blob, a cookie or credential API call inside the content scripts, or Zaply's own backend host appearing next to message-payload construction. None of those are in the current scan.

Key Reasons

• Zero malware, malware-signature, secret, dependency and tool-poisoning findings across 1,154 total matches
• Network findings (NET-FETCH-background.js-52/63/137 and NET-SOCKET_IO in content/assets/js/) match the advertised WhatsApp CRM sync behavior
• Extracted endpoints are CSS design tokens and clipped strings (color.text.accent.orange, border.radius.circle, above.sm); Atlassian and Statsig hosts come from a bundled SDK
• Both obfuscation hits sit in hashed build artifacts (v_7_4_3_84_..., CdHxSFqr.js) with no co-located malware signature
• No cookie, credential or login-domain access appears anywhere in the findings

False Positive Considerations

• 727 code-smell matches from bundled and minified JavaScript
• 403 IoC extractions including CSS design tokens and property chains misread as domains
• Obfuscation rules firing on webpack/Vite hashed bundle chunks
• Bundled SDK hosts (atlassian, statsigcdn) attributed to the extension's own traffic

Reviewed 2026-09-30; recommended action: monitor; model confidence 72%.