ELITE

AI Security Review

Evidence context: threat category none; evidence quality moderate.

ELITE is sold as a customer relationship manager layered on top of WhatsApp Web, organizing chats and contacts for small businesses. Version 7.4.3.86 returned 1,187 findings in this scan. The count itself is the least useful number here. What the findings describe matters more.

Start with what the extension asks for. The manifest declares no special permissions and no host permissions, which is an unusual shape for a tool that reads chat data. That observation is about the manifest, not proof of hidden access. Of the endpoints lifted from the code, app.wascript.com is the only one that could plausibly be the extension's own backend, and api.statsigcdn.com is a feature-flag and analytics CDN used across the web. The rest of that list, including border.radius.circle, btn.glass, color.border.accent.orange, calls.function.arguments.delta, above.sm and below.sm, reads as design tokens and event names pulled out of bundled JavaScript, not hosts the extension contacts.

Then the categories themselves. No malware signature matched anything in the package, and the malware-family bucket is empty too. Nothing fired in the secret category and nothing fired in the dependency category. The 754 code-smell alerts are the standard rules that trigger on minified or bundled JavaScript, the ones keyed to fetch calls, exec patterns and weak randomness. They land on extension bundles constantly. The 408 IoCs follow the same pattern, generated from minified files, hex fragments and property names.

The network findings deserve a close read, and they describe libraries rather than destinations. NET-JQUERY_AJAX appears in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb223.js. NET-SOCKET_IO appears in the chunk files ending 212.js and 148.js. NET-FETCH appears in background.js:137 and in several content chunks. jQuery ajax, socket.io and fetch are the ordinary plumbing of a chat product: socket.io holds the realtime connection open, fetch pulls data, and jQuery handles older requests. Detecting a networking library is not the same as detecting a malicious endpoint, and none of these findings names one.

The two obfuscation hits fit bundled code as well. OBFUSCATION-LARGE_BASE64 sits in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js, a filename pattern produced by webpack or Next.js builds, and large base64 blobs in build output are usually embedded fonts or images. OBFUSCATION-FUNCTION_INDIRECT in the chunk ending 259.js describes indirect function calls, which minifiers generate routinely.

A skeptic could argue the opposite case: an extension with 51 users, a developer identified only by the address [email protected], and a CRM that reads private WhatsApp conversations is a plausible place for data harvesting to hide. The empty permission set makes it hard to confirm from the manifest what the content scripts can reach. That argument fails on the evidence available, because the scan produced no malware signature, no credential-access pattern, and no transmission to an unexplained domain. Only app.wascript.com looks like a backend, and it matches the extension's own naming.

Key Reasons

• Zero malware signatures and zero malware-family matches across the bundle; secret and dependency categories are also empty.
• All network findings are library-usage detections (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) in content chunks and background.js:137, not connections to suspicious hosts.
• Listed 'endpoints' such as border.radius.circle, btn.glass and calls.function.arguments.delta are CSS design tokens and streaming event names misread as domains.
• The 754 code-smell and 408 IoC findings are the documented noise classes for minified/bundled JavaScript.
• Both obfuscation hits (LARGE_BASE64 in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js, FUNCTION_INDIRECT in the 259.js chunk) match webpack build output rather than deliberate hiding.

False Positive Considerations

• IoC extractor reading CSS design tokens and event constants as domains (border.radius.circle, btn.glass, calls.function.arguments.delta).
• Code-smell YARA rules firing on minified/bundled JavaScript (754 low-severity findings).
• Network rules detecting library usage (jQuery ajax, socket.io, fetch) instead of actual endpoints.
• Large base64 blob inside a webpack build artifact flagged as obfuscation.

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 75%.