Wazio

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Wazio is a Spanish-language CRM built to run inside WhatsApp Web. The copy captured here is version 7.4.3.87, published by a developer listed only as [email protected], with roughly 20 users. The scan recorded no declared permissions or host permissions, and no malware signatures, credential-theft indicators, or secret leaks anywhere in the package.

All 22 network findings are capability detections rather than destination findings. NET-FETCH, NET-SOCKET_IO and NET-JQUERY_AJAX appear in bundled files such as content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and background.js:137. They tell us the extension calls a server, opens a websocket and makes AJAX requests. That is what a CRM synchronising chats has to do. None of them points at a login page, a wallet, or a bank.

The endpoint list is where the scan goes wrong. It mixes one plausible vendor host, app.wascript.com, with extractor artefacts: border.radius.circle, btn.glass, calls.function.arguments.delta, above.sm, below.sm, artboard.phone and color.border.accent.orange are CSS values and JavaScript property chains, not domains. The Atlassian API hosts (api.atlassian-us-gov-mod.com and relatives) come from an Atlassian design-system package bundled into the extension. api.statsigcdn.com is Statsig feature flagging. None of these is a data sink.

Two obfuscation findings exist. OBFUSCATION-LARGE_BASE64 sits in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT sits in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Large inline base64 blobs and indirect function calls are the normal shape of webpack and esbuild output, including images and fonts inlined into JS. No malware signature matched in either file, and obfuscation without a malware signature in the same file is a weak signal.

The bulk of the report is code-smell hits and indicator matches from bundled dependencies. Code-smell rules fire on any non-trivial JavaScript, and the indicator count here is built from the CSS tokens and property chains above. Two findings actually describe the extension's behaviour: it fetches and it uses sockets.

A sceptic would point at the anonymous publisher, the 20-user install base, the unknown app.wascript.com backend and the two obfuscation hits, and argue a tool that reads WhatsApp conversations could quietly ship them somewhere. That is a claim about what we could not see. Nothing across the scan shows a credential domain, an exfiltration endpoint or a malware signature. A runtime capture of traffic to app.wascript.com and a look at the single manifest-analysis finding would settle the remaining question.

Key Reasons

• Zero malware signatures, zero secrets and zero credential-theft indicators across the full finding set.
• All 22 network findings are generic capability detections (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) in bundled content/assets/js files and background.js:137.
• The endpoint list is dominated by extractor artefacts such as border.radius.circle and calls.function.arguments.delta, plus bundled Atlassian and Statsig hosts.
• The two obfuscation findings sit in minified bundle files with no malware signature co-located in the same file.
• No suspicious external destination appears in the endpoints beyond the extension's own app.wascript.com backend.

False Positive Considerations

• 415 IoC hits built from CSS tokens and JavaScript property chains misread as domains
• 754 code-smell findings from YARA rules firing on bundled dependencies
• Obfuscation rules matching webpack/esbuild minified output and inline base64 assets
• Network findings are capability-only detections (fetch, socket.io, jQuery ajax) rather than destination-based detections

Reviewed 2026-10-14; recommended action: no action; model confidence 60%.