Feel Up

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Feel Up is a Chrome CRM extension, version 7.4.3.87, published by [email protected] to about 72 users. The manifest data captured lists no permissions and no host permissions, so the extension has no standing access to your tabs or browser APIs. Almost all of what follows concerns code shipped inside its own pages rather than privileged reach into the browser. The scan returned 1,188 items, and they resolve into 407 IoC matches, 756 code-smell hits, 22 network findings, 2 obfuscation findings, and zero malware or malware-signature matches.

The network findings describe ordinary CRM machinery. content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js makes jQuery ajax calls, background.js:137 and content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289137.js:1 issue fetch requests, and the NET-SOCKET_IO findings in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15, ...289149.js:64 and ...289175.js:37 are a Socket.IO client. Live chat, contact sync and message delivery are what a CRM does, and a persistent socket plus fetch is how web CRMs do it.

Among the endpoint strings, app.wascript.com belongs to WhatsApp automation tooling, api.statsigcdn.com serves feature flags, and api.atlassian.com, api.stg.atlassian.com and atlassian-isolated.net point at Atlassian's API. Those hostnames travel inside bundled third-party libraries, and with 72 users we cannot confirm which ones the extension actually contacts at runtime. The remainder of the endpoint list is extractor noise: border.radius.circle, btn.glass, color.border.accent.orange, below.sm, above.sm and calls.function.arguments.delta are CSS values and minified property chains, not servers.

Two obfuscation findings appear. OBFUSCATION-LARGE_BASE64 sits in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT sits in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1. Inline base64 blobs are routine in bundled assets for fonts, images and widget payloads, and a function invoked through a variable is plain JavaScript.

The strongest argument against treating this as noise is that base64 file. It sits in its own funnil/assets/js/ directory under a hash-style filename, and an embedded payload is how a malicious extension smuggles code past review. That argument loses force because nothing else lines up: no malware signature matched in the package, all 22 network findings name standard web libraries, and the extension asks for none of the permissions that would let it read your pages. A blob with no exfiltration route and no signature is a widget, not a payload.

The 756 code-smell hits are quality flags that fire on any large bundle, and the 407 IoC matches are strings the extractor cannot separate from domain names. Count carries no weight here. What would change this assessment: runtime capture showing funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js decoding into script that executes after install, or a network log showing data leaving for a host outside the set above.

Key Reasons

• No malware or malware-signature matches across 1,188 findings; the 756 code-smell and 407 IoC hits are documented noise categories.
• All 22 network findings name standard web libraries: jQuery ajax, fetch, and Socket.IO clients in content/assets/js/ and background.js.
• Endpoint list is dominated by extractor garbage such as border.radius.circle, btn.glass and calls.function.arguments.delta, which are CSS tokens and property chains, not hosts.
• Manifest lists no permissions and no host permissions, so the extension has no privileged access to page content or browser APIs.
• The two obfuscation findings are one inline base64 asset and one indirect function call, unaccompanied by any payload signature.

False Positive Considerations

• IoC extractor misreads minified property chains (border.radius.circle, calls.function.arguments.delta) as domains
• 756 code-smell findings on bundled web-app JavaScript
• jQuery, Socket.IO and fetch network rules fire on any bundled front-end
• Single inline base64 asset in a bundled file counted as obfuscation

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 72%.