Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io, reddit.com
YouZapCRM - WhatsApp Web com poder de CRM, automações e muito mais!
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- Today
- Version
- v7.4.3.89
- Artifact
- SHA256 77B…BD5
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
Requested Permissions
5 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
YouZapCRM is a customer relationship management tool designed for WhatsApp Web, published by [email protected]. The analysis of its codebase reveals no malware signatures and no evidence of credential theft or browser hijacking. The high volume of findings is driven almost entirely by automated scanner noise rather than actual malicious behavior.
The 409 indicators of compromise extracted from the code are predominantly false positives generated by the extractor misinterpreting frontend code structures as network domains. Strings like border.radius.circle, color.border.accent.orange, and calls.function.arguments.delta are clearly CSS utility classes and JavaScript object property chains, not actual network endpoints. The only legitimate external endpoint identified is app.wascript.com, which is a known WhatsApp automation platform and aligns perfectly with the extension's stated functionality. Other flagged strings like above.sm or artboard.phone are generic top-level domains or unrelated strings misread by the parser.
Network findings are limited to 22 instances flagging the use of standard web APIs. Files such as content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js and background.js trigger alerts for NET-JQUERY_AJAX, NET-SOCKET_IO, and NET-FETCH. These are fundamental methods for any modern web application to communicate with its backend servers, not indicators of data exfiltration. The two obfuscation findings (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769...CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/...260.js) are common in minified bundles or when extensions include specific third-party libraries that encode assets or use indirect invocation patterns.
The developer uses a generic email address and the extension has a very small user base of 8. While a small user base and generic publisher can sometimes indicate a throwaway malicious project, the actual code tells a different story. The 754 code-smell findings are all low-severity and typical of complex, bundled JavaScript applications. They reflect the presence of standard development patterns rather than hidden payloads. A skeptic might point to the generic developer email and the use of indirect function calls as reasons for concern, arguing that the extension could be hiding data exfiltration behind minified code. However, the complete absence of malware signatures, combined with the fact that the suspicious domains are literally CSS class names, makes a compelling case that the scanner is simply tripping over its own parsing logic. The extension operates within the expected boundaries of a niche CRM tool, and the findings do not reflect a compromised or malicious codebase.
Key Reasons
- Zero malware signatures detected across the entire codebase
- The 409 IoC findings are predominantly garbage, consisting of CSS properties like border.radius.circle and JavaScript object paths like calls.function.arguments.delta misidentified as domains
- Network findings exclusively flag standard web APIs rather than suspicious external endpoints
- The only relevant external endpoint, app.wascript.com, aligns with the extension's stated purpose as a WhatsApp automation and CRM tool
- The 754 code-smell findings are low-severity and typical of bundled or minified frontend dependencies
False Positive Considerations
- IoC extractor misidentifying CSS properties and JS object paths as domains
- Code-smell rules firing on bundled and minified JavaScript
- Standard web API usage flagged as network findings
Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 85%.
Chrome version history
Risk trend by version
15 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
waSuper
[email protected]
Wa Elo IA
[email protected]
Whapro – Automação, CRM e Vendas no WhatsApp Web
[email protected]
Vende+
[email protected]
WaListall | O Melhor CRM para WhatsApp Web – Teste Grátis
[email protected]
InfiChat
[email protected]