Mais Leads CRM

AI Security Review

Evidence context: threat category none; evidence quality strong.

Mais Leads CRM is a WhatsApp Web customer relationship management tool designed to organize chats and optimize business workflows. The extension relies heavily on standard web communication libraries to function. We see network findings like NET-SOCKET-IO and NET-JQUERY-AJAX firing across multiple files in the content/assets/js/ directory. These indicate the use of Socket.io for real-time messaging and jQuery for DOM manipulation. The background.js file also triggers a NET-FETCH finding at line 137. This is entirely expected for a background script handling asynchronous API calls to a remote CRM server. The automated scanner flagged 415 indicators of compromise and 754 code-smell findings. A closer look at the extracted indicators reveals they are almost entirely false positives. The extractor misidentified JavaScript property access chains and CSS values as domain names. Strings like border.radius.circle, calls.function.arguments.delta, and btn.glass are clearly object property references or styling rules, not actual network destinations. The code-smell findings are low-severity matches for standard programming patterns. This volume is heavily amplified by bundled third-party libraries residing in the content/assets/js/ directory, each triggering its own minor rule matches. Two obfuscation findings were recorded during the scan. The OBFUSCATION-LARGE_BASE64 rule triggered on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js. The OBFUSCATION-FUNCTION_INDIRECT rule fired on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Base64 encoding and indirect function calls can hide malicious payloads. They are also common in commercial software to protect proprietary business logic from reverse engineering. The actual network endpoints contacted include app.wascript.com, a known WhatsApp automation API provider. The list also includes several Atlassian domains, which are likely pulled in via a bundled UI or analytics SDK. Zero malware signatures matched the codebase. A skeptic might point to the developer email [email protected] and the presence of code obfuscation as signs of a shady operation. They would argue that a legitimate business tool has no reason to hide its source code. That is a fair concern. Commercial extensions often obfuscate their source to prevent competitors from copying their specific WhatsApp integration logic. Without a malware signature or a suspicious data exfiltration endpoint to back up the obfuscation finding, we cannot assume malicious intent. The extension simply protects its code while using standard web technologies to function.

Key Reasons

• Zero malware signatures matched the codebase
• 415 IoC findings are mostly property chains misread as domains
• 754 code-smell findings are low-severity noise from bundled dependencies
• Network endpoints include legitimate services like app.wascript.com and Atlassian domains
• Obfuscation findings lack malicious context and are consistent with commercial code protection

False Positive Considerations

• IoC extractor misidentifying property chains as domains
• Code-smell rules firing on bundled third-party libraries
• Obfuscation rules triggering on commercial code protection

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 85%.