WhatsTime CRM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WhatsTime CRM (version 7.4.3.87) is a WhatsApp customer-relationship tool. Its store description, in Portuguese, promises "Superpoderes ao seu Whatsapp", and the developer field holds only an email address, [email protected]. The extension ships its front-end as hashed webpack chunks under content/assets/js/, files such as v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js, alongside a service worker at background.js.

Nothing in this build matches a malware signature, and no finding points at a credential, cookie or banking origin. The single outside service with a real hostname is app.wascript.com, a WhatsApp messaging automation provider that fits a CRM's job. The rest of the endpoint list is extractor debris: border.radius.circle, color.border.accent.orange, btn.glass, artboard.phone and below.sm are CSS values and design-token strings lifted out of stylesheets. They are not hosts anyone can connect to. The build also records no host permissions and no permissions, which is a gap in manifest extraction more than a statement about reach, since a WhatsApp sidebar has to inject somewhere.

The 22 network findings carry titles like NET-FETCH-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289137.js-1, NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js-64, NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js-13 and NET-FETCH-background.js-137. Each records that a file calls fetch, holds a socket.io connection, or issues a jQuery ajax request. Live chat sync and contact lookup need exactly those calls. None of the titles names a destination host. The 754 code-smell findings are all low severity and, together with the 416 IoC matches, make up the bulk of the count. Those two classes are the platform's documented noise floor.

The counterargument is obfuscation plus anonymity. A skeptic would point at OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js, and a publisher identified only by an email address on a listing with 22 users. Those are fair things to raise. The base64 block sits in a folder named "funnil", next to funnel-builder assets, and a large base64 payload is how an embedded icon, font or locale table looks after bundling. Function indirection is what every minifier produces. Neither finding shares a file with a malware signature, and no malware signature matched anywhere in the build. What would change this reading: decoding that base64 to a second-stage script, or a network finding naming a host that is not the extension's own service. Neither is present.

The findings describe a minified commercial front-end talking to its own backend, using socket.io and jQuery because a chat product requires them. The volume comes from library patterns and extractor matches inside bundled chunks, not from behaviour that steals, redirects or hides.

Key Reasons

• Zero malware signatures and zero credential, cookie or banking indicators across 1,195 findings; the 416 IoC matches fall into the documented garbage classes.
• All 22 network findings (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX on hashed content chunks and background.js:137) record library API usage only, with no destination host named.
• The one real third-party hostname, app.wascript.com, is a WhatsApp messaging automation service consistent with the extension's stated CRM purpose.
• Endpoint entries such as border.radius.circle, color.border.accent.orange and artboard.phone are CSS design tokens misread as domains.
• Both obfuscation hits sit on bundled webpack assets (funnil/...CgnacD38.js, content/...289260.js) rather than on a payload file co-located with malware signatures.

False Positive Considerations

• 416 IoC matches contain CSS and design-token strings (border.radius.circle, btn.glass, below.sm) misread as domains by the extractor
• 754 low-severity code-smell findings, the class that fires on any non-trivial bundled JavaScript and never drives a verdict
• Network titles only flag presence of fetch, socket.io and jQuery ajax calls inside hashed chunks, without naming a host
• Large base64 and indirect function calls appear on webpack build output (funnil/assets/js/...CgnacD38.js, content/assets/js/...289260.js), which is bundling rather than packing

Reviewed 2026-10-14; recommended action: suppress false positive; model confidence 78%.