GmCrm

AI Security Review

Evidence context: threat category none; evidence quality weak.

What the extension does

GmCrm describes itself as “um CRM no Google Chrome” — a customer relationship management tool inside the browser. The version we scanned (7.4.3.83) ships with a single declarative permission set, which is literally empty. It asks for no host access, no storage, no cookies, no tabs. A CRM that cannot touch any webpage or store any data would be useless for credential theft or browser hijacking.

What the network findings show

The 20 network findings fall into two buckets. Three NET-FETCH hits in background.js (lines 45, 56, 127) are the extension’s own service worker calling an external API — normal for any extension that syncs data with a backend. The other 17 hits all live inside content/assets/js/ with names like v_7_4_3_83_aff5b0bf-...12.js and include NET-SOCKET_IO, NET-FETCH, and NET-JQUERY_AJAX flags. These are the bundled frontend framework — Socket.IO for real-time updates, jQuery for ajax calls, and standard fetch wrappers — that power whatever web interface the CRM opens in a new tab or popup. None of the findings identify a suspicious upstream domain, a custom search engine, or an endpoint on a known tracking or exfiltration service.

What the obfuscation findings actually mean

Two obfuscation hits. OBFUSCATION-FUNCTION_INDIRECT in a versioned bundle file at content/assets/js/v_7_4_3_83_aff5b0bf-...254.js is a minifier fingerprint — webpack and similar bundlers generate indirect function calls by design when they hoist module wrappers. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/48b4d5a0-...B_awpHSQ.js is a large base64 blob inside a namespace called “funnil,” the extension’s own UI framework. Base64-encoded assets (images, font data, WASM payloads) are standard in modern single-page apps. There are zero zero-width Unicode steganography flags, no eval chains, and no domain-obfuscation tricks like hex-encoded URL construction.

Malware silence is meaningful

The scanner ran the full malware-signature and IoC extractor suites. Result: zero malware signatures fired. Zero IoCs were extracted — no IP addresses, no domain names, no Bitcoin addresses, no suspicious URLs. Extensions that exfiltrate data or serve as proxy nodes invariably leave artifact trails in one of those buckets. An extension with 20 network findings and zero IoCs is making plain, detectable HTTP or WebSocket calls, not hiding destinations behind string-split decoding.

Strongest counterargument

A skeptic would point to the generic Gmail-based developer identity ([email protected]) and the low user count as signs this could be a disposable malware vehicle that simply hasn’t been caught yet. That skepticism is fair — anonymous publishers with fresh extensions deserve scrutiny. But for a malware author to invest in a versioned, framework-heavy bundle with Socket.IO integration, jQuery, and a named internal UI library (“funnil”), then ask for zero permissions and attack zero hosts, would be an extraordinarily inefficient delivery strategy. Real malicious extensions request tabs, cookies, webRequest, or broad host patterns. This one requests none, reaches no unknown external domain in any finding, and carries no IoC baggage.

Risk score inflation here is a pure artifact of the bundled frontend code. The tool correctly flags network primitives inside minified asset bundles, but because 17 of the 20 hits come from a single app bundle directory, the volume is a packaging artefact, not an aggression signal.

Key Reasons

• Zero malware signatures matched across the entire extension bundle.
• Zero IoCs (domains, IPs, URLs) extracted — network findings triggered on API primitives, not destinations.
• Extension declares an empty permissions list and requests no host access.
• Obfuscation findings are explained by minified bundles and base64-encoded framework assets.
• Network findings are concentrated in a versioned frontend app bundle using standard libraries (Socket.IO, jQuery).

False Positive Considerations

• Bundled frontend framework (Socket.IO, jQuery, fetch) in content/assets/js/ triggers multiple NET-* findings.
• Webpack/minifier output flags OBFUSCATION-FUNCTION_INDIRECT without malicious context.
• Base64-encoded UI assets in funnil/ vendor bundle flagged as OBFUSCATION-LARGE_BASE64.
• Zero IoCs extracted despite 20 network findings—indicating scanner sensitivity to network primitives, not suspicious destinations.

Reviewed 2026-09-27; recommended action: suppress false positive; model confidence 82%.