Eddye

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension "Eddye" describes itself as a CRM for WhatsApp Web, published by [email protected] with 50 users at version 7.4.3.87. The findings total 1,189 items, but the nature of those findings tells a clear story of scanner noise rather than malicious behavior.

The 410 IoC findings are almost entirely false positives from the extractor misreading CSS design tokens as domain names. Entries like border.radius.circle, color.border.accent.orange, btn.glass, calls.function.arguments.delta, and artboard.phone are property access chains from a design system, not network endpoints. The extension also bundles Atlassian dependencies, which produce IoC matches for api.atlassian.com, api.stg.atlassian.com, and api.statsigcdn.com. These are legitimate infrastructure domains from a known vendor, not suspicious callbacks.

The 22 network findings all flag standard web APIs in content/assets/js/ files: NET-FETCH, NET-SOCKET_IO, and NET-JQUERY_AJAX. Socket.IO is a common real-time communication library used by CRM platforms for live chat updates. jQuery AJAX calls are routine. None of these findings point to unknown command-and-control infrastructure.

Two obfuscation findings exist at medium severity. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js flags a large base64 string, which commonly represents embedded fonts, images, or configuration data. OBFUSCATION-FUNCTION_INDIRECT in a content script file matches patterns typical of minified JavaScript bundles. Neither finding co-locates with malware signatures, which remain at zero.

The 754 code-smell findings are all low severity and match the documented noise pattern of YARA rules firing on non-trivial JavaScript. They include generic patterns like property access, fetch calls, and environment variable references that appear in virtually any modern web application.

A skeptic might point to the generic developer email, the small user count of 50, and the absence of declared host permissions as suspicious. A CRM that cannot access web pages seems non-functional. However, the absence of permissions means the extension cannot exfiltrate data from other sites even if it wanted to. The lack of malware signatures, the absence of suspicious domains outside the extension's own service (app.wascript.com is a known WhatsApp automation platform), and the clear false-positive patterns in the IoC data all point to a legitimate but small tool flagged by scanner artifacts rather than actual threats.

Key Reasons

• 410 IoC findings are false positives from CSS design tokens misread as domains (border.radius.circle, color.border.accent.orange)
• Zero malware signatures matched the extension code
• Network findings flag standard web APIs (fetch, Socket.IO, jQuery AJAX) in content scripts
• Bundled Atlassian dependencies generate IoC matches for legitimate infrastructure domains
• Extension declares no host permissions, limiting its ability to access data outside WhatsApp Web

False Positive Considerations

• IoC extractor misreads CSS design tokens and property access chains as domain names
• Bundled npm dependencies (Atlassian libraries) generate multiplicative IoC matches
• YARA code-smell rules fire on standard JavaScript patterns (fetch, property access)
• Obfuscation findings match minified bundle output and embedded base64 assets

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 82%.