FATURE MAIS

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension "FATURE MAIS" presents itself as a CRM tool for WhatsApp Web. A review of the codebase reveals zero malware signatures and no evidence of credential theft or browser hijacking. The 1,195 total findings are almost entirely noise generated by automated scanning tools misinterpreting standard frontend development patterns.

The network findings consist of 22 detections for standard web APIs. Files like content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and background.js trigger NET-SOCKET_IO, NET-FETCH, and NET-JQUERY_AJAX alerts. These are not suspicious external connections. They are the scanner identifying the use of popular JavaScript libraries for making HTTP requests and handling real-time communication, which is expected for a CRM application that needs to sync chat data.

The 414 IoC detections are a textbook example of extractor false positives. The network endpoints list includes strings like border.radius.circle, color.border.accent.orange, and calls.function.arguments.delta. These are not command-and-control servers. They are CSS design tokens and JavaScript object keys that the IoC parser mistakenly classified as domain names. The few legitimate domains present, such as app.wascript.com, belong to known WhatsApp API service providers and align with the stated purpose of the tool.

The two obfuscation findings, OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in a content script, are also benign. Large base64 strings are typically embedded fonts, images, or configuration objects. Indirect function calls are a standard output of JavaScript minifiers and bundlers, which compress code for production deployment.

The 756 code-smell findings are all low severity and stem from the same bundled dependencies. They flag generic programming patterns, not malicious behavior. The extension is published by [email protected] and has a small user base of 40 installs. While a low user count can sometimes indicate a newly deployed malicious tool, the complete absence of malicious payloads here points to a small, independent developer building a niche productivity tool.

A skeptic might point to the empty permissions and host permissions arrays in the manifest data, arguing that a WhatsApp CRM should require broad host access to read web.whatsapp.com, and its absence implies hidden or deceptive behavior. However, Chrome extensions can inject content scripts into specific sites using the content_scripts manifest key without needing explicit host_permissions in some configurations, or the manifest parser simply failed to extract them. The lack of permissions does not override the fact that the codebase contains zero malware signatures and no suspicious network exfiltration. The scanner tripped on minified code and CSS variables. The extension shows no malicious intent.

Key Reasons

• Zero malware signatures matched in the codebase
• Network findings are limited to standard JavaScript library calls within bundled assets
• IoC volume is inflated by design tokens and CSS properties misidentified as domains
• Code-smell findings are low-severity noise typical of minified frontend bundles
• Obfuscation findings are isolated to standard base64 assets and indirect function calls

False Positive Considerations

• IoC extractor misidentifying CSS design tokens and object keys as domains
• Code-smell rules firing on minified JavaScript bundles
• Obfuscation rules triggering on base64 encoded assets and standard bundler output

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 88%.