Etivi: Inteligencia Artificial para WhatsApp

AI Security Review

Evidence context: threat category none; evidence quality strong.

The Etivi extension for WhatsApp automation presents a clean security profile with 22 findings, all classified as medium-severity network detections. Crucially, the findings summary shows zero malware signatures, zero obfuscation findings, and zero code-smell findings — the three categories that typically indicate malicious behavior.

All 21 network findings detect basic web development patterns: fetch calls in background.js:22 and background.js:130, socket_io connections in content/assets/js/v_7_4_3_31_3bb7ccc9-19a6-4120-bc11-61c531f17fc322.js:4171, and jquery_ajax calls in crm/assets/js/a56befbe-dc0f-4060-9944-0c49bb0bdad8.BOUJIqqs.js:1. These are standard operations for any extension that needs to communicate with backend services. Importantly, none of these network findings reveal suspicious domain names or data exfiltration patterns — they simply confirm that the extension makes network requests, which is expected for a WhatsApp automation tool.

The extension's stated purpose aligns with its technical behavior: "aumenta tus ventas 10X con la automatización avanzada y mejor gestión de mensajes en WhatsApp" (increase sales 10X with advanced automation and better WhatsApp message management). The file structure supports this — content scripts in content/assets/js/ handle WhatsApp page interactions, while crm/index.js:2 and background.js manage backend communication. This architecture is consistent with legitimate CRM/sales automation extensions.

Counterargument: A skeptic might argue that the developer attribution ([email protected]) is suspicious because it's an email address rather than a verified company name, and the low user count (38 users) could indicate a recently deployed malicious extension. However, these factors alone do not constitute evidence of malicious intent. The absence of malware signatures, obfuscation, and suspicious IoCs in the actual code is the stronger signal. Many legitimate small businesses publish extensions under email addresses, and low user counts are common for niche automation tools targeting specific markets.

The evidence quality is strong for ruling out malicious behavior because the CVEQ analysis found nothing beyond expected network activity. Without malware signatures, obfuscation, or suspicious domains, there is no basis to classify this extension as malicious or risky.

Key Reasons

• Zero malware signatures or obfuscation findings
• Network findings are basic fetch/socket_io calls without suspicious domains
• Extension serves legitimate business purpose (WhatsApp automation for sales)
• No code-smell or IoC findings detected

False Positive Considerations

• Network findings detect standard fetch/socket_io calls without suspicious domains
• Zero malware signatures or obfuscation findings
• Extension has legitimate business purpose (WhatsApp automation for sales)
• Low user count does not indicate malicious behavior

Reviewed 2026-04-28; recommended action: no action; model confidence 75%.