Lightiius CRM tu plataforma de ventas con IA para WhatsApp

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Lightiius CRM extension generates 30 findings, all medium severity, consisting entirely of generic network activity detections. The 29 network findings identify fetch calls in crm/index.js:2, background.js:465, background.js:136, background.js:500, chatbot/index.js:2515, chatbot/license.js:106, funnil/index.js:1, and multiple files under content/assets/js/. Two findings detect socket_io connections in content/assets/js/v_7_4_3_31_3bb7ccc9-19a6-4120-bc11-61c531f17fc3120.js:37 and content/assets/js/v_7_4_3_31_3bb7ccc9-19a6-4120-bc11-61c531f17fc3149.js:39. These findings detect the presence of network calls but do not identify any specific suspicious domains.

This extension's description states it "convierte WhatsApp en una máquina de ventas con inteligencia artificial" (converts WhatsApp into an AI sales machine). A CRM tool that integrates with WhatsApp must communicate with backend servers to sync customer data, manage conversations, and process AI features. The file paths crm/index.js, chatbot/license.js, and funnil/index.js indicate legitimate CRM functionality modules. The socket_io connections are standard for real-time chat applications.

Critically, the findings summary shows zero malware signatures, zero obfuscation findings, zero code-smell findings, and zero IoC findings identifying specific suspicious domains. The CVEQ threat model explicitly states that "IoC COUNT alone is meaningless. Only specific, non-generic suspicious domains matter." These findings flag generic network activity patterns, not malicious behavior.

The strongest counterargument is that the developer uses a personal Gmail address ([email protected]) and the extension has zero users, which could indicate an unvetted or potentially malicious extension. While these are legitimate concerns about publisher trustworthiness, the actual code analysis provides no evidence of malicious behavior. The network findings are expected for any web-connected CRM extension. Without malware signatures, obfuscation, credential theft indicators, or suspicious domain connections in the evidence, there is insufficient basis to classify this as malicious. The findings themselves are false positives—they flag normal extension functionality as suspicious activity.

Recommendation: Suppress these false positive findings and monitor the extension for future updates that might introduce actual malicious behavior.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation findings
• Zero suspicious domains identified in network findings
• Network findings are generic fetch/socket calls expected for CRM functionality
• File paths (crm/index.js, chatbot/license.js) indicate legitimate CRM modules

False Positive Considerations

• Generic network activity detection without specific domain analysis
• Socket.io and fetch calls are normal for CRM/web applications
• No malware signatures or obfuscation present
• Network findings count inflated by legitimate backend communication

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 75%.