Vecta Hub - Tecnologia que ajuda sua empresa a vender mais

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Vecta Hub is a WhatsApp Web add-on marketed as a CRM, chatbot and follow-up suite for small businesses. It ships as a Chrome extension, version 7.4.3.87, published under the contact address [email protected], with 8 users at scan time. The bundle holds content scripts under content/assets/js/ plus background.js. The endpoints the scanner pulled include app.wascript.com, api.statsigcdn.com and api.atlassian.com. The last two belong to bundled SDKs (a feature-flag client and an Atlassian library); app.wascript.com is the one address that reads like this product's own service. The rest of that endpoint list is junk: 4vz.hn, 9j.dk, above.sm and artboard.phone are fragments cut out of minified code, not hosts anything contacts.

Every network finding is a library pattern. None names a destination that is out of place. NET-SOCKET_IO fires in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and three other chunk files, NET-FETCH fires in background.js:137 and in a dozen content chunks, and NET-JQUERY_AJAX fires across the same chunk family. Those titles describe how the code talks to a server, a live Socket.IO channel plus ordinary fetch and ajax calls, which is what a chat tool needs to receive new messages and push them into a CRM pipeline.

Two obfuscation findings sit in the medium band. OBFUSCATION-LARGE_BASE64 was raised on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. The file names carry content hashes, which is what webpack and Vite emit, and indirect function calls are what a minifier produces when it swaps named references for array lookups. A large base64 literal inside a bundle is normally an inlined image, font or source map. Neither finding sits next to a malware signature: the scan recorded zero malware-signature matches, zero malware matches and zero tool-poisoning matches across 1,232 findings, and the 755 low-severity code-smell hits are the generic JavaScript patterns that fire on any packaged app.

A fair objection: a WhatsApp automation tool can read every conversation a user has and forward it to a server the user has never heard of, app.wascript.com is not a household name, the developer line is an email address rather than a registered brand, and 8 users is a thin install base to judge by. All of that holds. What it does not change is that the store description states the CRM and chatbot function openly, the manifest data here lists no host permissions and no API permissions, and the categories that would flag concealed data theft came back empty. A CRM cannot work without a backend, so the Socket.IO connection is the product doing what it advertises.

What would move this off a clean read: a malware signature sharing a file with the base64 blob under funnil/, a hardcoded endpoint outside the product's own domain, or host permissions granting access to sites the described feature does not need. None of those are present in this evidence.

Key Reasons

• Zero malware-signature, malware and tool-poisoning matches across 1,232 findings; all 22 network findings are library detections (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) in bundled chunk files under content/assets/js/.
• The two obfuscation findings, OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js, match bundler and minifier output rather than concealed payloads.
• 755 low-severity code-smell findings and 452 IoCs are documented noise categories; the endpoint list contains extractor junk such as 4vz.hn, 9j.dk and artboard.phone.
• The only first-party-looking endpoint, app.wascript.com, fits the disclosed WhatsApp CRM and chatbot function, and the manifest data lists no host or API permissions.
• No credential, cookie, search-hijack or proxyware indicators appear anywhere in the finding set.

False Positive Considerations

• 755 low-severity code-smell rules firing on minified bundled JavaScript
• 452 IoCs dominated by extractor garbage domain fragments (4vz.hn, 9j.dk, artboard.phone)
• 22 network findings are library-pattern detections (Socket.IO, fetch, jQuery ajax) inside content chunks
• Large base64 literal and indirect function calls in content-hashed bundler output

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 72%.