DGUESTS

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The scan of DGUESTS 7.4.3.85 returns 1,166 findings and none of them describe malicious behavior. Zero malware signatures matched. The mass sits in two categories the platform already treats as noise: ioc (412) and code-smell (730, every one at severity low). The 21 network findings, 2 obfuscation findings and single manifest-analysis finding are the ones worth reading, and each resolves to bundled code or build output.

Take the endpoint list first. It contains border.radius.circle, color.icon.accent.orange, calls.function.arguments.delta, avatar.online and a run of two-letter country codes such as ae.jobs and af.pf. Those are CSS custom property names, a streaming API field name and sliced-up property chains that the extractor mistook for hosts. The endpoints carrying real meaning are app.wascript.com, which fits a WhatsApp CRM backend, and api.statsigcdn.com, a feature-flag service, with api.atlassian.com and the other Atlassian hosts sitting inside bundled library text rather than live call sites.

The network findings follow that pattern. NET-FETCH-background.js-52, NET-FETCH-background.js-63 and NET-FETCH-background.js-137 sit in the service worker that syncs the CRM with its backend. The rest, NET-SOCKET_IO-content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920143.js-64 and the NET-JQUERY_AJAX pair in the same versioned bundle directory, come from a socket.io client and jQuery compiled into a minified content script. A chat-organization tool opening a socket and issuing XHR calls matches how the extension works. None of those calls target a login page, a payment provider or a cookie endpoint.

The two obfuscation findings describe minification. OBFUSCATION-LARGE_BASE64 lands on funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js, a hashed build artifact where inline base64 for fonts and icons shows up routinely. OBFUSCATION-FUNCTION_INDIRECT lands on a versioned bundle file, ...20253.js. Neither file pairs a decoded payload with an eval chain, and neither sits next to a matched malware rule.

A skeptic would push back here, and the pushback has weight. A WhatsApp Web CRM reads conversations by design, and app.wascript.com has no public reputation behind it. DGUESTS lists zero users, so there is no community track record to lean on either. What would settle the question is a runtime capture of the requests the background service worker sends while a chat sits open. Static analysis cannot separate syncing CRM labels from forwarding message text, and the evidence here shows no code path that selects conversation content for upload.

The inflated score traces to minified bundles, CSS token names read as domains, and generic code-quality rules. No malware signature, no login-domain targeting, and no exfiltration logic appear anywhere in the scan.

Key Reasons

• Zero malware signatures across 1,166 findings
• Endpoint list contains CSS token names (border.radius.circle, color.icon.accent.orange) and API field paths (calls.function.arguments.delta), not real hosts
• Network findings sit in background.js and in socket.io/jQuery bundles under content/assets/js/v_7_4_3_85_..., consistent with a chat sync client
• Both obfuscation findings (LARGE_BASE64 in funnil/assets/js/0c7a903c-...9ZuTaqvp.js, FUNCTION_INDIRECT in a versioned bundle) match minified build output
• No login, banking or cookie endpoints among the routed traffic

False Positive Considerations

• IoC extractor splitting CSS variable names and property chains into domain-shaped strings
• 730 low-severity code-smell rules firing on minified bundled libraries
• Base64 and indirect-call obfuscation rules matching normal bundler output
• Empty permissions and host_permissions arrays producing little manifest context

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 72%.