Z Turbinado

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The score attached to Z Turbinado (version 7.4.3.87, 71 users) comes almost entirely from volume. Of the 1194 findings, 415 are IoC matches and 754 are code-smell hits, while malware and malware-signature counts both sit at zero. The two categories that would change a verdict are empty. The network bucket holds 22 medium hits, and each one is a detector for a JavaScript primitive rather than a host: NET-FETCH-background.js-137, NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js-15, and a run of NET-JQUERY_AJAX entries inside content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js. A CRM that keeps chat tabs synchronised against a dashboard needs fetch, websockets and an HTTP client, and those three cover all 22.

The endpoint list supports that reading. Most entries in it never existed as hostnames: border.radius.circle, btn.glass, color.border.accent.orange, above.sm and below.sm come from CSS custom property names or from minified property chains the extractor split at a dot. The identifiers with real infrastructure behind them are api.statsigcdn.com (feature flags and product analytics), api.dev.atlassian.com together with api.stg.atlassian.com (documentation links), and app.wascript.com, the vendor's own backend. Nothing in the list points at a login page or a banking domain, and the package matches no credential-harvesting pattern.

Two medium obfuscation findings deserve a fair hearing. OBFUSCATION-LARGE_BASE64 sits in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT sits in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. A large encoded blob inside a browser extension can carry executable payload. What makes that unlikely here is the company it keeps: the blob file matches no malware signature, references no suspicious domain, and its naming pattern (UUID prefix plus build hash) follows the same generated bundle convention used across content/assets/js/. FUNCTION_INDIRECT fires on webpack module indirection, which shows up in every minified bundle in this package.

The skeptic's case rests on the raw counts, on the anonymous publisher listed only as [email protected], and on the fact that a WhatsApp CRM reads the content of every chat its user opens. That access is genuine, and the manifest's empty permission and host permission lists make it impossible to bound from the package alone. The scan still shows no exfiltration path: the only endpoints with real servers behind them are the vendor's own service and standard analytics infrastructure. A runtime capture of the socket.io channel opened in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js would close that gap by showing where synced chat data lands.

Key Reasons

• Zero malware and zero malware-signature findings; the 1194 total splits into 415 IoC and 754 code-smell entries that carry no behavioural weight
• Every network finding (NET-FETCH-background.js-137, NET-SOCKET_IO in v_...12.js, NET-JQUERY_AJAX in v_...23.js) is an API detector, consistent with a CRM that syncs chats to a dashboard
• The endpoint list contains extractor artifacts plus known infrastructure (api.statsigcdn.com, api.dev.atlassian.com, app.wascript.com); no login, banking or unknown exfiltration domain appears
• Obfuscation findings sit in generated bundle files (funnil/assets/js/9cf42769-...CgnacD38.js, content/assets/js/v_...260.js) with no malware signature or suspicious domain co-located
• No credential, cookie or history access appears in the manifest, and the empty permission list is the main open question rather than evidence of abuse

False Positive Considerations

• IoC extractor read CSS design tokens and minified property chains as hostnames (border.radius.circle, btn.glass, color.border.accent.orange, above.sm, below.sm)
• NET-FETCH, NET-SOCKET_IO and NET-JQUERY_AJAX detections fire on standard web primitives inside minified vendor bundles under content/assets/js/
• 754 code-smell hits on webpack-style bundle output with zero malware or malware-signature matches anywhere in the package
• OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT land on generated build files whose naming matches the rest of the bundle set

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 72%.