Was Hub

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Was Hub is a Chrome Web Store CRM for WhatsApp Web, published under the contact address [email protected] at version 7.4.3.84, with four users. The scan output is dominated by code-quality flags and indicator extractions, and contains no malware signatures and no malware detections at all. The manifest record holds a single manifest-analysis entry and no host permissions or API permissions, so nothing here shows the extension asking for broad access to your browsing.

The network findings line up with what a WhatsApp CRM has to do. background.js:52, background.js:63 and background.js:137 are plain fetch calls. content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js triggers two NET-JQUERY_AJAX findings, while v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a146.js and v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a170.js trigger NET-SOCKET_IO. A tool that tracks conversations in real time needs a socket and periodic fetches. Those files carry a version string in the filename, which is how a production bundle looks, and the code inside is minified rather than hand-written.

The endpoint list is where the extractor stops being useful. calls.function.arguments.delta, border.radius.circle, color.border.accent.orange, btn.glass and artboard.phone are property chains and design-token names, not hosts. avatar.online and above.sm are fragments of longer strings. The entries that are real hosts are api.statsigcdn.com, a feature-flag CDN, and api.atlassian.com plus api.stg.atlassian.com, Atlassian's API, both ordinary third-party services. Nowhere in the list is there a query.* or search.* domain, a new-tab replacement host, or a login or banking domain.

Two findings deserve a closer look. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js is what a minifier produces when it aliases functions through a lookup table. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js is a base64 block inside an asset bundle. That directory name is unusual, and the blob is the one item in this scan that the filename alone does not explain. Decoding it would settle the question; a bundle like that usually holds an inlined image, font or worker script, and no malware signature sits beside it in the same file, which is the pairing that would change this verdict.

A skeptic would argue the opposite: an extension with four users, an email address where a publisher name should be, no declared permissions and an unexplained base64 blob is exactly the profile to distrust. That is fair, and it is why this is a considered call rather than a clean pass. The reason it holds is that the behaviours we look for leave marks this scan does not contain. There is no malware signature, no credential or cookie access pointed at a real service, no browser-hijack domain, and no endpoint that reads like an exfiltration host. What is left are the findings a bundled build of a chat client produces on its own.

Key Reasons

• No malware signatures and no malware detections in the scan; the bulk of the output is code-quality flags and indicator extractions.
• The network findings are fetch, jQuery AJAX and Socket.IO calls in background.js and content/assets/js/v_7_4_3_84_*.js, which is what a realtime WhatsApp CRM requires.
• The endpoint list is mostly non-hosts such as calls.function.arguments.delta, btn.glass and border.radius.circle; the real hosts are api.statsigcdn.com and api.atlassian.com.
• Both obfuscation hits sit in minified bundle or asset files with no malware signature in the same file.
• No host permissions declared, and no hijack, credential or banking domains anywhere in the findings.

False Positive Considerations

• 413 indicator extractions are string fragments, object property chains and CSS token names misread as domains.
• 727 code-quality findings are scanner noise that fires on any non-trivial JavaScript.
• 21 network findings are expected fetch, jQuery AJAX and Socket.IO calls inside a bundled chat client.
• Obfuscation hits land on minified bundle files and a base64 asset, not on hand-written payload code.

Reviewed 2026-09-26; recommended action: suppress false positive; model confidence 75%.