EAI +

AI Security Review

Evidence context: threat category none; evidence quality moderate.

EAI + is a Chrome extension from the developer contact [email protected]. Its store description, in Portuguese, describes a CRM layer for WhatsApp Web that organises chats and adds business tools. The shipped code is a set of content scripts under content/assets/js/, with hashed names such as v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js, plus a single fetch call in background.js:137. The version is 7.4.3.87, with 27 users.

The scanner found no malware. Across 1,188 findings there are zero malware signatures, zero secrets and zero tool-poisoning items, and the severity buckets above medium are empty. What remains splits into two noisy piles. The 754 code-smell items are what happens when YARA rules meet bundled JavaScript, and the 409 IoCs come from the same place. The endpoint list shows the extractor misfiring outright: border.radius.circle, btn.glass, artboard.phone and color.border.accent.orange are CSS class and design-token names, calls.function.arguments.delta is a property chain from a streaming JSON parser, and ae.jobs, af.pf and be.audio are two-letter fragments. Entries like api.stg.atlassian.com, api.dev.atlassian.com and api.statsigcdn.com come from bundled vendor SDKs rather than the extension's own calls.

The 22 network findings are named for the browser API each file uses, not for a destination: NET-SOCKET_IO in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js, NET-JQUERY_AJAX in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, and NET-FETCH in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28927.js and several siblings. A CRM with a live inbox opens a socket and polls a server, which is precisely what these markers record. The one host in the list that is neither a design token nor a library endpoint is app.wascript.com, and its name tracks the product rather than a third-party collector.

Two items deserve naming. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, a bundled asset carrying an embedded base64 blob, and OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Neither file also matches a malware rule, and one medium obfuscation marker inside a vendor bundle is not the shape of a packed payload.

The strongest argument against this reading is the extension's position. A script running inside web.whatsapp.com sees every conversation, and the socket.io channel beside app.wascript.com means a server receives whatever the panel collects. If that server were unnamed infrastructure, or if the manifest requested broad host access, the picture would change. Instead the manifest declares no permissions and no host permissions, the developer address matches the product's own domain, and nothing in the code mimics a well-known extension. Confirming what app.wascript.com receives needs a live capture, which a static pass cannot produce.

Key Reasons

• Zero malware, malware-signature, secret and tool-poisoning findings, with no critical or high severity items in the set.
• All 22 network findings are named for the API detected (NET-FETCH, NET-JQUERY_AJAX, NET-SOCKET_IO) rather than for a destination host.
• The endpoint list contains CSS design tokens and JS property chains (border.radius.circle, color.border.accent.orange, calls.function.arguments.delta), which are IoC extractor artifacts.
• 754 code-smell items and 409 IoCs match the expected volume for minified, bundled content scripts in content/assets/js/.
• Description and developer contact ([email protected]) line up with the product, and no known extension is being copied.

False Positive Considerations

• IoC extractor parsed CSS design tokens and JS property chains as hostnames
• Code-smell rules firing on bundled and minified content scripts
• Network findings record web API usage, not destination endpoints
• Single base64 blob in the bundled asset funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js

Reviewed 2026-10-11; recommended action: monitor; model confidence 74%.