ViaShopModa

AI Security Review

Evidence context: threat category none; evidence quality moderate.

ViaShopModa is a CRM panel for WhatsApp Web, and the code behind it matches that description. The content scripts under content/assets/js/ open socket.io channels (NET-SOCKET_IO in v_7_4_3_87_...28912.js at line 15 and in v_7_4_3_87_...28966.js at line 1) and issue HTTP calls (NET-FETCH in background.js:137, NET-JQUERY_AJAX in v_7_4_3_87_...28923.js). A dashboard that mirrors chat state needs a persistent socket and an HTTP client, which is what those findings record.

The raw count of 1,195 findings is almost entirely extractor noise. 754 of them are code-smell rules of the kind that fire on any bundle mentioning fetch, crypto or process.env. 416 are IoC matches, and the endpoint list shows how they were produced: entries such as border.radius.circle, calls.function.arguments.delta and color.border.accent.orange are CSS custom properties and design-token names rather than hosts. The rest of the endpoint list is shared infrastructure (api.statsigcdn.com and googleapis/gstatic class entries) plus Atlassian hostnames pulled in from bundled dependencies. None of it points at a login page, a payment provider or a bank.

Zero malware signatures matched. No finding names a credential API, a cookie jar or a history rewrite. There is no custom search domain, no new tab replacement and no proxy or relay code. The manifest data attached to version 7.4.3.87 lists no permission strings and no host permissions, so the extension is not requesting access beyond what its content scripts use on the page they run in.

The obfuscation bucket has two entries. OBFUSCATION-LARGE_BASE64 flags a blob in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, which in bundled front-end code is normally an inlined font, icon sprite or image. OBFUSCATION-FUNCTION_INDIRECT flags content/assets/js/v_7_4_3_87_...289260.js, and indirect calls are standard output from any bundler. Neither file carries a malware family match, which is the pairing that would matter.

The one endpoint worth naming is app.wascript.com. It sits outside the CDN and analytics infrastructure seen elsewhere in the list, and a CRM has to send chat data somewhere, so this is the vendor's own service. That is a trust question about the publisher rather than a code finding.

A skeptic would argue that the purpose itself is the risk: a content script inside WhatsApp Web can read every message, 175 users is a small install base, and the publisher is an email address rather than a company. If app.wascript.com were quietly uploading message text, static analysis of this kind would not show it. That is a fair point and it applies to every WhatsApp client extension. It does not change the verdict, because nothing in this scan shows covert collection: the network hits are generic socket and fetch calls, the two obfuscation hits sit in bundle artefacts with no malware match beside them, and no endpoint or string targets authentication. What would settle the open question is watching what background.js:137 puts in its request body, not more pattern matching.

Key Reasons

• Zero malware signatures across 1,195 findings; 754 are code-smell rules and 416 are IoC matches, both documented noise classes
• Network findings are ordinary socket.io, fetch and jQuery AJAX calls in content/assets/js/ and background.js:137, which is what a live chat dashboard uses
• The endpoint list contains design-token strings such as color.border.accent.orange and border.radius.circle, showing the IoC extractor parsed CSS property names as hosts
• The two obfuscation hits (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769...CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/...289260.js) are bundle artefacts with no malware match in the same file
• No custom search domain, credential API, cookie access or history rewrite appears anywhere in the scan

False Positive Considerations

• Code-smell rules firing on minified bundled JavaScript (754 findings)
• IoC extractor treating CSS/design-token strings and property chains as network domains
• Bundled library code triggering fetch, socket.io and jQuery AJAX network rules
• LARGE_BASE64 and FUNCTION_INDIRECT obfuscation rules matching normal bundler and inlined-asset output

Reviewed 2026-10-14; recommended action: suppress false positive; model confidence 74%.