WAVENDY

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WAVENDY is a CRM layer for WhatsApp Web, and the code the scanner could read lines up with that job. Of the 24 findings, 21 are network calls: NET-FETCH at background.js lines 52, 63 and 137, NET-SOCKET_IO across the content/assets/js/ bundle (including v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1146.js line 64 and v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1170.js line 37), and NET-JQUERY_AJAX in v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a121.js at lines 1 and 13. A product that keeps a WhatsApp conversation list in sync needs each of those: a socket for live message events, fetch for API reads and writes, and Ajax inside the injected UI. The evidence carries no destination address at all and the bundle lists no network endpoints, so the scanner is reporting that outbound calls exist rather than where they go.

The remaining two findings are obfuscation flags. OBFUSCATION-FUNCTION_INDIRECT fires at line 1 of content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js, and OBFUSCATION-LARGE_BASE64 fires at line 1 of funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js. Both are single-line files with content-hash names, the signature of webpack or rollup output. Indirect function references and inline base64 are ordinary in compiled front end code, where the base64 usually turns out to be an embedded icon or font. Minified bundles are not obfuscation in the sense that matters here, and these two hits account for the entire 'obfuscation' category.

Everything else came back clean. No malware signature matched, no indicator pointed at a login domain, and there is no cookie or token handling code, no dependency risk and no hardcoded secret. There is also no custom search engine, no new-tab replacement and no history rewriting, which is what a hijacker would need to monetise a browser. What stays true is that a WhatsApp CRM holds unusual trust: it runs inside the page where the user is already logged in and can read every conversation it is pointed at. That capability is the product itself, and installing it hands message content to whoever runs the backend.

The skeptic's case is that an anonymous publisher, a small install base and a content script reading all WhatsApp traffic is exactly the shape of an exfiltration tool. That is a fair shape to worry about. What keeps it short of a malicious verdict is the total absence of the things that separate exfiltration in practice from chat sync: no external domain anywhere in the evidence, no credential or session harvesting, no matching malware signature. The flagged calls sit in files named after the extension version, inside a bundled front end, doing what the description says they do.

What would change this: if the fetch and socket targets referenced from background.js:52 and background.js:63 resolve to a host unrelated to a CRM service, or if the base64 block in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js decodes to executable code.

Key Reasons

• All 21 network findings are fetch, socket.io and jQuery Ajax call sites in background.js and the content/assets/js/ bundle, which is the sync plumbing a WhatsApp Web CRM requires.
• No malware signature, IoC, secret, dependency or code-smell finding matched, and nothing targets credential, cookie or login-domain access.
• Both obfuscation flags sit at line 1 of single-line, content-hash-named bundle files (v_7_4_3_84_...a1254.js and funnil/assets/js/fa595624-...CdHxSFqr.js), the pattern of webpack/rollup output.
• No custom search engine, new-tab replacement or history manipulation, so the browser-hijack profile is absent.
• Residual risk is inherent to the product: it reads WhatsApp message content, and the bundle lists no endpoints or permission strings, leaving the backend operator unverified.

False Positive Considerations

• OBFUSCATION-FUNCTION_INDIRECT and OBFUSCATION-LARGE_BASE64 firing on minified webpack output in content/assets/js/ and funnil/assets/js/
• NET-FETCH, NET-SOCKET_IO and NET-JQUERY_AJAX rules firing on any client-server sync code in a chat CRM
• No network endpoints or permission strings extracted, so call destinations are unknown and the empty permissions list looks like a collection gap rather than manifest evidence
• Version-suffixed hash filenames (v_7_4_3_84_.js) treated as single-line obfuscated files

Reviewed 2026-09-30; recommended action: monitor; model confidence 68%.