SPEEDYX

AI Security Review

Evidence context: threat category none; evidence quality moderate.

SPEEDYX describes itself as a CRM for WhatsApp Web, and the code in the bundle matches that pitch. The content scripts under content/assets/js/ open a live socket rather than only drawing a UI. Those vendor files carry build hashes in their names (v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js, ...175.js, ...66.js), and the network findings inside them are ordinary: NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH. A chat CRM needs a persistent connection to sync conversations, so socket.io and fetch calls are the expected shape of this product. background.js:137 holds the one fetch that lives outside the content-script bundles.

Most of the endpoint list is not endpoints. above.sm, ae.jobs, ae.online, af.pf, be.audio and avatar.online are entries from a public suffix list bundled inside a URL or cookie library. border.radius.circle, btn.glass, artboard.phone and color.border.accent.orange are design tokens from a CSS-in-JS bundle. calls.function.arguments.delta is a key name from a streaming API response parser. These strings reach the indicator list because the extractor scans minified JavaScript for anything shaped like a domain. The 415 IoCs are this, repeated. None of it is a place the extension sends chat data.

The two obfuscation findings follow the same pattern. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js is an inline base64 asset inside a hashed build chunk, which is how bundlers embed fonts, icons and small images. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js describes indirect function invocation, which every minifier emits when it renames a call site. Neither describes code written to hide from a reviewer.

Across all 1194 findings there are zero malware signatures, zero malware detections and zero credential-access findings. Seven hundred and fifty-four are code-smell rules (eval, weak randomness, string building) that fire on any large JavaScript codebase, and they match bundled dependencies under content/assets/js/ and funnil/assets/js/.

The strongest counterargument is real: SPEEDYX runs a content script against WhatsApp Web, so it can read every message in every conversation, and it ships that data over a socket to app.wascript.com. The publisher is listed only as an email address, [email protected], and the install base is 15 people, so there is no track record to lean on. That is a fair reason to weigh what the product is designed to do. It doesn't change what the scan actually found. Four hundred indicators and two obfuscation labels would matter if they pointed at a bank login page or a cookie store. Here they point at a public suffix list, a CSS theme and a webpack chunk.

What would change this verdict: a manifest requesting cookie, webRequest or tab-injection access beyond what a WhatsApp content script needs, or traffic to a domain that isn't the extension's own service. app.wascript.com is the only listed endpoint that belongs to a real service, and it is consistent with a CRM backend. Nothing else here supports a malicious reading.

Key Reasons

• Zero malware signatures and zero malware detections across 1194 findings, with 754 low-severity code-smell rules and 415 IoCs accounting for the volume.
• The endpoint list is dominated by non-domains: public suffix entries (above.sm, ae.jobs, be.audio), CSS tokens (border.radius.circle, btn.glass) and the parser key calls.function.arguments.delta, showing the extractor misread minified bundles.
• NET-SOCKET_IO, NET-JQUERY_AJAX and NET-FETCH matches sit in build-hashed vendor chunks under content/assets/js/, which is expected traffic for a real-time WhatsApp CRM.
• The obfuscation hits are OBFUSCATION-LARGE_BASE64 in a hashed webpack chunk (funnil/assets/js/9cf42769-...CgnacD38.js) and FUNCTION_INDIRECT in a minified bundle, both build artifacts.
• app.wascript.com is the only endpoint belonging to a real service and is consistent with the product's own backend.

False Positive Considerations

• Public suffix list bundled in a URL library parsed as 415 IoC domains
• CSS-in-JS design tokens (border.radius.circle, btn.glass, color.border.accent.orange) read as network endpoints
• Minified vendor chunks under content/assets/js/ producing generic NET-FETCH, NET-SOCKET_IO and NET-JQUERY_AJAX matches
• 754 code-smell rules firing on bundled dependencies with no malware or credential findings

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 75%.