CRMSIM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

CRMSIM is a CRM for WhatsApp Web, published in Portuguese with a developer contact at extensao.store. The scanned build, 7.4.3.87, produced no malware signatures and no matches in the malware category. What it produced instead is framework code plus detector noise.

Every network finding names a library pattern inside a hashed vendor bundle. NET-SOCKET_IO appears in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js, NET-JQUERY_AJAX in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js and content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js, and NET-FETCH in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289137.js, content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289235.js and background.js:137. Socket.IO is how a chat dashboard holds a live connection to its server; jQuery AJAX and fetch are how a web app moves data. None of these findings name a destination address, a stolen credential or a payload.

The endpoint list is mostly extraction artifacts. api.statsigcdn.com is a feature-flag CDN, api.atlassian.com is Atlassian, and app.wascript.com is the vendor's own service. Mixed in with those are border.radius.circle, calls.function.arguments.delta, color.border.accent.orange and btn.glass, which are CSS values and API field names the extractor read as hostnames. ae.jobs, af.pf and artboard.phone are country-code-shaped strings, not services. Nothing here points at a bank, a login page or a search redirect.

Two obfuscation findings deserve a look. OBFUSCATION-LARGE_BASE64 points at funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Base64 blocks that size in a web bundle are normally inlined fonts, icons or images, and indirect calls are standard minifier output. Neither file carries a matched malware family and neither is paired with an external loader.

The remaining code-smell matches and IoC hits fired on bundled dependencies. That ratio is what both detectors produce on any minified npm build, so the volume says nothing about intent here.

A skeptic can point at app.wascript.com plus Socket.IO and argue that chat content leaves the browser. It does, and that is the product. A hosted CRM cannot mirror WhatsApp conversations without sending them to the CRM's server. The findings that would change this reading are specific: a malware signature in one of the hashed bundles, an endpoint serving a credential page, a host permission on a banking or login domain, or proof that the base64 block in the funnil directory is executed rather than rendered. None of those appear.

One gap is worth noting. The scan returned no declared permissions and no host permissions. That does not prove the extension is inert, because content scripts carry their own match patterns outside the host permission list, and a working WhatsApp Web tool needs one. Confirming the manifest's content script matches would close that thread.

Key Reasons

• Zero malware signatures and zero malware-category matches across the full finding set; the volume is code-quality and IoC extraction
• All 22 network findings are library patterns (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) inside hashed vendor bundles, consistent with chat-sync behaviour
• Endpoint list is dominated by property-chain artifacts such as border.radius.circle and calls.function.arguments.delta plus known infrastructure (api.statsigcdn.com, api.atlassian.com)
• Two obfuscation findings (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js) match inlined assets and minifier output
• Manifest analysis returned empty permission and host permission lists, which is a parsing detail worth checking rather than an indicator of harm

False Positive Considerations

• Bundled minified vendor JavaScript with hashed filenames inflating code-smell and IoC counts
• IoC extractor reading CSS values and API field names as domain names
• Inline base64 assets flagged as obfuscation
• Standard library usage (jQuery AJAX, Socket.IO, fetch) flagged as network activity

Reviewed 2026-10-15; recommended action: monitor; model confidence 75%.