WhatsJud

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WhatsJud is a CRM overlay for WhatsApp Web, published under the contact address [email protected] at version 7.4.3.87 with nine users on the Chrome Web Store. Its manifest declares no permissions and no host_permissions. The work happens in content scripts injected into the WhatsApp page, and that is where every network finding sits.

Those network findings describe ordinary chat-app plumbing. NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15 and three sibling socket.io hits flag the library a CRM uses to hold a live connection while you work through conversations. NET-FETCH-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289137.js:1 and its siblings are fetch calls, and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js:1 is jQuery's XHR wrapper. background.js:137 makes one more fetch from the service worker. No finding shows a request to a login page, a payment page or a bank.

The endpoint list is where the noise shows. It runs to entries like border.radius.circle, btn.glass, color.border.accent.orange, above.sm, below.sm and calls.function.arguments.delta. Those are CSS property tokens and JavaScript property chains that the extractor read as hostnames. They do not resolve. They are the raw material behind the 405 IoC hits, and they say nothing about what the extension contacts. Two real entries, api.statsigcdn.com (feature flags) and app.wascript.com, are service endpoints a CRM would call. With no host permissions declared, the extension cannot reach arbitrary sites anyway.

Total findings are 1184. Of those, 405 are the IoC entries above and 754 are code-smell hits, which fire on string concatenation, eval-adjacent patterns and bundled vendor code in any large JavaScript project. Zero malware signatures, zero malware-family matches, zero secrets and zero dependency findings. The severity split stops at medium; nothing is rated high or critical.

The two obfuscation findings deserve naming. OBFUSCATION-LARGE_BASE64-funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1 flags a base64 blob inside an asset under funnil/, and OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1 flags indirect function calls. Bundlers and minifiers emit both patterns routinely. Neither file carries a malware signature alongside the obfuscation, which is the combination that would turn this into a real finding.

A skeptic would point at that base64 asset plus a publisher identified only by an email address and a nine-user install base. That pairing is unusual for a CRM shipping a 7.4.x version number, and the blob has not been decoded. Fair. But a malicious verdict needs a specific capability or destination, and there is none here: no credential access, no search-engine replacement, no proxy routing, no signature match anywhere in 1184 findings. The volume explains the score, and one undecoded asset is worth another look rather than a takedown.

Key Reasons

• Zero malware-signature and zero malware-family matches across 1184 findings, including in the two files flagged for obfuscation
• The 405 IoC entries are misread CSS tokens and JS property chains (border.radius.circle, btn.glass, calls.function.arguments.delta) that do not resolve as hostnames
• All 22 network findings are socket.io, fetch and jQuery ajax calls in content/assets/js and background.js, the libraries a live chat-sync CRM needs
• 754 code-smell hits are the expected byproduct of bundled vendor JavaScript, and no finding is rated high or critical
• Manifest declares no permissions and no host_permissions, which caps what the extension can reach

False Positive Considerations

• IoC extractor reading CSS property tokens and JavaScript property chains as domain names
• Code-smell rules firing on minified and bundled vendor JavaScript
• socket.io and fetch calls that are inherent to a real-time chat CRM, not evidence of exfiltration
• base64 blob inside a bundled asset folder, a normal build artifact pattern

Reviewed 2026-10-11; recommended action: monitor; model confidence 72%.