Wisender CRM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Wisender CRM extension exhibits classic false-positive patterns from the CVEQ analysis pipeline. The findings bundle contains 2293 IoC detections, but zero malware signatures and zero obfuscation findings. This combination strongly indicates benign code with noisy IoC extraction.

The network findings reveal legitimate communication patterns. The file injectScript.bundle.js:12190 triggers NET-SOCKET_IO-injectScript.bundle.js-12190, which uses Socket.IO—a standard WebSocket library for real-time data synchronization. Similar socket_io calls appear at injectScript.bundle.js:12206 and injectScript.bundle.js:22336. The fetch calls in contentScript.bundle.js:48284, background.bundle.js:357, and images/bootstrap.js:147 are standard HTTP requests. These patterns match a CRM tool that syncs lead data between web pages and a backend service.

The IoC domains detected—x.id, n.pix.name, l.serverprops.media, a.stream—do not match known malicious patterns. They lack the query., search., hp.* prefixes that indicate browser hijacking. These domains likely represent CDN endpoints, analytics services, or the extension's own infrastructure. The XIOC extractor is documented to produce massive false-positive volumes from property access chains and hex substrings in minified JavaScript.

The manifest analysis finding MANIFEST-SENSITIVE-PERM-TABS in manifest.json is expected for a CRM extension. The tabs permission enables the extension to read page content for lead extraction, which aligns with the extension's stated purpose of converting leads to customers.

The 50 code-smell findings fall under the postinstall_* and credential-access patterns that the threat model explicitly classifies as noise. These rules fire on basic Node.js patterns like fetch, exec, fs, and crypto. The code-smell count of 50 is consistent with bundled dependencies triggering YARA rules, not malicious behavior.

The strongest counterargument is the sheer volume of 2293 IoC findings, which might suggest hidden malicious infrastructure. However, the threat model explicitly states that IoC COUNT alone is meaningless and that the XIOC extractor produces massive false-positive volumes. The specific IoCs shown lack the characteristics of malicious domains. More critically, the absence of malware signatures and obfuscation—two high-confidence threat indicators—overrides the IoC count. If this were malicious code, the analysis would show malware family signatures or obfuscation techniques, neither of which appear in the findings.

The developer uses a Gmail address ([email protected]) rather than a corporate domain, which is a minor concern. However, Wisender is a legitimate CRM company with a public website. The low user count (28) does not indicate maliciousness—it simply reflects a niche business tool.

The verdict is likely_false_positive because the evidence shows legitimate network patterns, zero malware signatures, zero obfuscation, and IoCs that match known XIOC noise patterns. The recommended action is suppress_false_positive to prevent unnecessary alerts on this extension.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation findings
• Network patterns (socket_io, fetch) are legitimate for CRM functionality
• IoC domains lack malicious patterns (no query., search., hp.*)
• Tabs permission aligns with stated CRM purpose

False Positive Considerations

• XIOC extractor noise (2293 IoCs without malicious domain patterns)
• Code-smell rules firing on standard Node.js patterns
• Socket.IO and fetch are legitimate communication libraries
• No malware signatures or obfuscation detected

Reviewed 2026-04-30; recommended action: suppress false positive; model confidence 75%.