InterZap

AI Security Review

Evidence context: threat category none; evidence quality moderate.

InterZap layers CRM features onto WhatsApp Web: organising chats, tracking contacts, running a business from the WhatsApp tab. That job needs a content script inside the WhatsApp page and a background worker keeping a session alive, and both are here. The scan returned 1194 findings, and none of them are malware signatures, leaked secrets or tool-poisoning hits. The two biggest groups are 754 code-quality entries and 415 loose string matches, the sort of hit that fires on almost any minified JavaScript. The count of findings says very little about intent.

The 22 network findings are library detections sitting in bundled vendor code. NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js and NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js fire because the shipped bundle includes a jQuery build and a socket.io client, and a run of NET-FETCH hits across content/assets/js/ plus one at background.js:137 fire on ordinary fetch calls. Each detection name identifies which browser API appears in the file. A chat tool that syncs state with its own backend contains a socket client by design, and none of these findings name a destination.

Most of the extracted connection endpoints are not endpoints. border.radius.circle, btn.glass, color.border.accent.orange and calls.function.arguments.delta are CSS custom properties and JSON field names pulled from a design-token theme; above.sm, ae.jobs and af.pf are the same kind of fragment. api.statsigcdn.com is Statsig's feature-flag CDN. app.wascript.com matches the extension's own service. No banking, webmail or login host shows up in that list, which is where a stealing extension would have to appear.

The two obfuscation entries sit in bundled files. OBFUSCATION-LARGE_BASE64 is in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, where a large base64 block is most likely an embedded image, font or wasm asset. OBFUSCATION-FUNCTION_INDIRECT is in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js, and indirect calls are normal webpack and rollup output. Neither file carries a malware signature alongside the obfuscation, which is the combination that would matter.

The strongest argument against reading this as scanner noise: an extension that can read every WhatsApp conversation and holds a socket open to a third-party host has both the access and the channel to copy messages off-device, and the publisher is reachable only at [email protected], with no company name anywhere. That is a real data-handling question, and nothing in these findings answers it. A CRM sending chat metadata to its own server is disclosed behaviour; these findings do not show anything leaving for a host that is not the vendor's own service or a CDN. What would change the picture is the manifest. It shows no permissions and no host permissions, which is almost certainly incomplete extraction for a tool that has to run inside web.whatsapp.com. Confirming which hosts InterZap can touch is the one check that would settle its scope.

Key Reasons

• Zero malware signatures, zero secrets and zero tool-poisoning findings across 1194 results; 754 are low-severity code-quality rules and 415 are loose IoC string matches.
• All 22 network findings are library detections (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) inside minified vendor bundles under content/assets/js/ and background.js, describing API presence rather than behaviour.
• The endpoint list is dominated by design-token and CSS fragments (border.radius.circle, btn.glass, color.border.accent.orange, calls.function.arguments.delta) plus legitimate infrastructure (api.statsigcdn.com) and the vendor's own app.wascript.com.
• The two medium obfuscation findings (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-...CgnacD38.js, OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/...289260.js) match embedded assets and webpack output, with no malware signature in the same file.
• No login, banking or webmail host appears anywhere in the extracted endpoints, so there is no evidence of credential or session targeting.

False Positive Considerations

• IoC extractor reading CSS custom properties and design-token strings as domain names
• YARA code-quality rules firing 754 times on minified bundled JavaScript
• Vendor bundles (jQuery, socket.io) producing library-level network detections
• Obfuscation heuristics flagging base64 assets and indirect calls in bundled code

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 72%.