SellUP

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The SellUP extension describes itself as a CRM for WhatsApp Web, and the code structure supports this purpose. Files are organized into content/assets/js/ and funnil/assets/js/ directories with versioned JavaScript bundles. The network findings across files like content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js and background.js detect standard web APIs: fetch calls, Socket.IO connections, and jQuery AJAX requests. These are routine communication methods for any web application that syncs data with a backend server.

The 411 IoC findings deserve scrutiny. Many of the extracted "domains" are not domains at all. Strings like border.radius.circle, color.border.accent.orange, and calls.function.arguments.delta are CSS property names and JavaScript property access chains that the IoC extractor misidentified as network endpoints. The legitimate-looking domains in the list belong to Atlassian infrastructure (api.dev.atlassian.com, api.stg.atlassian.com), Statsig's feature flag CDN (api.statsigcdn.com), and app.wascript.com, which aligns with the extension's WhatsApp integration purpose.

No malware signatures matched any file in the extension. The 754 code-smell findings are all low severity and fire on standard patterns like fetch usage and environment variable access. These rules trigger on virtually any non-trivial JavaScript bundle and carry no diagnostic value on their own.

Two obfuscation findings exist. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js detects a large base64-encoded string, which commonly appears in bundled assets like fonts or encoded images. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js detects indirect function calls, a pattern produced by minifiers like webpack and esbuild. Neither finding co-occurs with malware signatures in the same file.

A skeptic might point to the low user count of 32 and the generic developer email [email protected] as signs of an untrustworthy operation. Those facts are accurate. A small user base and anonymous developer do warrant caution in general. However, the extension's code matches its stated purpose, contains zero malware signatures, and its suspicious-looking network indicators dissolve under inspection into CSS properties and bundled library artifacts. The findings volume comes from known extractor noise patterns, not from malicious behavior in the code. The extension declares no special permissions, which limits what it can do regardless of intent.

Key Reasons

• Zero malware signatures across all scanned files
• IoC list contains CSS properties and code fragments misidentified as domains
• Network findings detect standard web APIs (fetch, Socket.IO, jQuery AJAX)
• Obfuscation findings are consistent with minified bundled code, not malicious obfuscation
• Extension purpose (WhatsApp CRM) matches its code structure and network endpoints

False Positive Considerations

• IoC extractor misidentifies CSS properties and property access chains as domains
• Code-smell rules fire on standard JavaScript patterns in bundled code
• Network findings detect routine API usage rather than suspicious endpoints
• Obfuscation rules trigger on minified bundle output from webpack or esbuild

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 75%.