Kentro

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Kentro is a WhatsApp Web CRM tool distributed from a developer email address ([email protected]) with 7 users. The evidence reveals 21 network findings across multiple bundled JavaScript files, primarily fetch and Socket.IO calls, alongside two obfuscation findings in asset files.

The critical gap is that the evidence bundle contains no network_endpoints data, making it impossible to assess whether these requests target legitimate Kentro servers, third-party analytics, or suspicious domains. The findings themselves (NET-FETCH-background.js-52, NET-SOCKET_IO spanning multiple versioned asset files) confirm the extension makes network calls, but the destination URLs are not provided. This is a structural limitation of the data, not a fingerprint of malicious intent.

The obfuscation findings deserve scrutiny. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js and OBFUSCATION-LARGE_BASE64 in a Funnil asset file signal indirect function invocation and base64-encoded payloads. In isolation, these are consistent with minified bundled code (webpack, esbuild); minification alone is not malware. However, obfuscation + network calls + no declared permissions + unverified developer identity creates an ambiguous picture that warrants explanation.

The strongest counterargument is that a WhatsApp Web CRM legitimately needs to connect to backend servers and bundle frontend libraries. Modern JavaScript build tools (Vite, Webpack) produce exactly this pattern: bundled libraries with indirect function calls and base64 strings, plus fetch/Socket.IO for API communication. If Kentro's network calls target its own backend ([email protected] or a service domain), this finding profile is benign.

What resolves this: visibility into the actual hostnames the extension contacts. A manifest declaring hosts or host permissions would also clarify scope. Currently, we can confirm network activity exists but cannot confirm it is either malicious or legitimate. The low user count (7) suggests either a brand-new extension or a niche tool, neither a strong signal either way.

Key Reasons

• 21 network calls (fetch, Socket.IO, jQuery AJAX) across multiple bundled files with no declared host permissions
• Obfuscation findings (function indirection and large base64 strings) in asset files without visibility into their purpose
• Developer identity is an email address ([email protected]) rather than a verified publisher account
• No network_endpoints data provided, making it impossible to assess whether requests target legitimate or suspicious domains
• Low user count (7) consistent with either a newly published or niche extension

False Positive Considerations

• Bundled JavaScript (Vite/Webpack) naturally produces function indirection and minification patterns flagged as obfuscation
• Network findings are expected in any extension that communicates with a backend; severity depends on endpoint identity, which is absent from the bundle

Reviewed 2026-09-30; recommended action: runtime analysis; model confidence 55%.