FR VENDAS PRO

AI Security Review

Evidence context: threat category none; evidence quality moderate.

FR VENDAS PRO is a Portuguese-language CRM packaged as a Chrome extension, published under [email protected], sitting at version 7.4.3.87 with 41 users. The scanned code is a web application bundle: a background script plus a tree of hashed build files under content/assets/js/. Nothing matched a malware signature, and the secret, dependency, malware and tool-poisoning categories are all empty.

The 22 network findings are library detections. NET-JQUERY_AJAX fires at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js:13, NET-SOCKET_IO at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15, and NET-FETCH at background.js:137. jQuery AJAX, socket.io and fetch are the ordinary plumbing of a browser-based sales tool, and socket.io is how a CRM pushes live chat and lead updates into the page. Each rule matches the shape of a call and says nothing about where the call goes.

The endpoint list is where the extraction goes wrong. Entries such as border.radius.circle, color.border.accent.orange, btn.glass and calls.function.arguments.delta are CSS property names and JavaScript property paths lifted out of minified code and reassembled as hostnames. above.sm, below.sm and ae.jobs are the same artifact with country-code tails. Two entries deserve a name: app.wascript.com, a WhatsApp messaging service that a Brazilian sales CRM would plausibly call, and api.statsigcdn.com, a feature-flag CDN. Nothing in the list is a login, banking or payment host.

Two obfuscation findings remain. OBFUSCATION-FUNCTION_INDIRECT at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js is what a bundler emits when direct calls become indexed references, and the file sits in the same hashed build tree as the rest of the frontend. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js is a base64 block inside a build artifact whose folder name means "funnel", a first-party CRM view.

A skeptic's strongest point is that the extension declares no permissions and no host permissions, yet background.js:137 performs a fetch, and a base64 blob cannot be read from a rule match alone. Read that way, the package looks like a loader hiding its payload. Two facts push back. Hashed filenames plus an inlined base64 asset are standard output from a frontend build pipeline, and a loader of that kind would normally arrive with a malware signature or a beacon domain, of which this bundle has none. If the manifest really does declare no host permissions, the fetch in background.js cannot reach an arbitrary host in the first place.

The 754 code-smell matches and the 423 IoC entries are low-severity noise in a bundle this size. What is left after removing them is a CRM that talks to its own backend over socket.io and fetch.

Key Reasons

• Zero malware signatures, zero tool-poisoning findings and zero hardcoded secrets across the scanned bundle
• All 22 network findings are library-pattern rules (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) that match call syntax, not destinations
• Extracted endpoint list is dominated by CSS property names and JSON key paths misread as hostnames (border.radius.circle, calls.function.arguments.delta, btn.glass)
• The two obfuscation findings sit inside hashed build artifacts under content/assets/js/ and funnil/assets/js/, consistent with a frontend bundler
• No URL, cookie, credential or exfiltration finding appears in the manifest, and no flagged domain relates to a login or payment service

False Positive Considerations

• IoC extractor converted CSS property names and JavaScript property paths into hostnames (border.radius.circle, color.border.accent.orange, calls.function.arguments.delta)
• Network findings are library detection rules (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) rather than evidence of a suspicious endpoint
• 754 code-smell findings are low severity and expected in any bundled web application
• Obfuscation findings are minified build output and an inlined base64 asset in a hashed filename tree

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 70%.