Etivi+ CRM para WhatsApp™ WEB.

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This WhatsApp CRM extension triggered 26 findings, all medium severity, consisting of 25 network detections and 1 manifest analysis finding. The network findings are exclusively generic fetch and socket_io call detections in bundled JavaScript files: injectScript.bundle.js (lines 45817, 64593, 45796, 63663, 101147, 146462), contentScript.bundle.js (lines 39986, 37603, 39765, 39851), and background.bundle.js (lines 742, 512). These are standard network API calls expected in any extension that communicates with a backend service.

Critically, there are zero malware signatures, zero obfuscation findings, and zero code-smell findings. The XIOC extractor did not extract any specific suspicious domains—only generic network call types were detected. The findings are all located in .bundle.js files, which are webpack/esbuild minified outputs where network patterns are expected to trigger generic detections.

The extension's purpose as a WhatsApp CRM tool (described as "gestiona tu empresa como todo un profesional") aligns with legitimate business use cases. CRM extensions for WhatsApp Web commonly make API calls to manage contacts, messages, and business data. The developer email [email protected] is somewhat anonymous but not completely hidden.

Counterargument: A skeptic could argue that network activity in a WhatsApp integration extension could indicate credential theft or data exfiltration. However, this argument fails because: (1) there are no malware signatures in any file, (2) no obfuscation was detected which would typically accompany malicious payloads, (3) no specific suspicious domains were extracted from the network calls, and (4) the extension has 142 users with no reported issues. If this were credential theft, we would expect to see code-smell findings related to credential access patterns, obfuscation to hide malicious code, and specific suspicious domains in the IoC extraction—none of which are present. The findings represent known false-positive patterns where generic network API detections fire on legitimate bundled JavaScript.

Key Reasons

• Zero malware signatures detected across all files
• Zero obfuscation findings present
• Network findings are generic fetch/socket_io detections without specific suspicious domains
• All findings located in bundled/minified JavaScript files where such detections are expected
• Extension serves legitimate WhatsApp CRM business use case

False Positive Considerations

• Generic network call detections (fetch/socket_io) in bundled JavaScript files
• No malware signatures detected in any file
• No obfuscation findings present
• No specific suspicious domains extracted from network activity

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 75%.