ZarpGo

AI Security Review

Evidence context: threat category none; evidence quality moderate.

ZarpGo presents as a WhatsApp Web CRM extension with a Portuguese description and a developer contact email ([email protected]). The scanner identified 1,174 findings across four categories: IoC (423), code-smell (727), network (21), and obfuscation (2). However, this volume is misleading and reflects known false-positive patterns rather than genuine threats.

The most significant signal is the complete absence of malware signatures. No ransomware, banking trojan, spyware family, or credential-stealing payload matched the code. This rules out the most dangerous threat profiles.

Network findings are concentrated in three types of files: background.js (3 findings) and numerous bundled asset files named content/assets/js/v_*.js (18 findings). These file names are consistent with transpiled or webpack-bundled application code. The titles (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) describe normal web communication patterns, not suspicious protocols. Without seeing the actual URLs being fetched, we cannot assess risk, but the finding counts are inflated by the presence of multiple nearly-identical asset files, each triggering separate detection.

Obfuscation findings total two. One matches FUNCTION_INDIRECT in a bundled asset file (content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js), and one matches LARGE_BASE64 in a funnil asset (funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js). Both are consistent with transpiled or minified production code. No obfuscation findings co-locate with malware signatures, which is the key indicator of intentional payload hiding.

The network endpoints list is almost entirely false-positive noise. Most entries are property-access chains extracted from minified JavaScript: 'calls.function.arguments.delta', 'color.border.accent.orange', 'color.icon.accent.orange', 'color.text.accent.orange', 'border.radius.circle', 'btn.glass'. These are not network destinations; they're JavaScript object properties. A few entries like 'ae.jobs', 'ae.online', 'af.pf' are domain fragments or TLDs without context, also artifacts of the extraction process. The legitimate Atlassian and statsig endpoints (api.dev.atlassian.com, api.statsigcdn.com) are CDN and analytics infrastructure that bundled frameworks routinely reference.

A skeptic might object: how can we trust an extension with 1,174 findings? The answer is that finding count is not evidence of threat. The IoC extractor produced 423 false-positive domains by parsing minified JavaScript as though it were a hosts file. The code-smell detector flagged 727 low-severity patterns that trigger on nearly all non-trivial JavaScript. Together, they create the illusion of risk. What matters is the nature of findings, not their quantity: zero malware signatures, zero credential-theft indicators, zero browser hijacking IoCs, and obfuscation only in bundled transpiled assets. These are the signals we weight.

The extension warrants routine monitoring for version updates, but the current evidence does not support a malicious classification.

Key Reasons

• Zero malware signatures detected despite 1174 total findings
• Network findings localized to bundled asset files with generic names (content/assets/js/v_*.js), consistent with minified framework code
• Obfuscation findings limited to two files: one FUNCTION_INDIRECT in bundled assets, one LARGE_BASE64 in a funnil asset—both expected in transpiled/minified code
• Network endpoints list contains only property-access chains (e.g., 'calls.function.arguments.delta', 'color.border.accent.orange') and domain fragments ('ae.jobs', 'ae.online')—classic IoC extractor false positives
• Code-smell findings (727 of 1174) are low-severity noise; no credential_* or postinstall_* rules cited as malware indicators

False Positive Considerations

• Bundled JavaScript assets (content/assets/js/) triggering multiplicative network and obfuscation findings per file
• IoC extractor misreading minified property chains as domain names (e.g., 'calls.function.arguments.delta', 'color.border.accent.orange')
• Large base64 blobs in transpiled framework code (funnil/assets/js/) flagged as obfuscation

Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 82%.