WhaScale - Um passo à frente do seu concorrente

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The finding count on WhaScale is 1,188, and almost none of it describes this extension's own behavior. Malware signature matches: zero. What the scanner produced was 754 code-smell hits and 409 indicator extractions, both typical output for a minified bundle, plus 22 network pattern matches. The network category is where a reader should look first, because that is where data movement would show up.

Every network finding sits in bundled vendor code. The titles repeat the same hashed filenames: NET-JQUERY_AJAX in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, NET-SOCKET_IO in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js, NET-FETCH in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289137.js and content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289179.js and background.js:137. These rules fire on HTTP client calls. They do not say where the calls go. The same few hashed files account for the whole set, which is what a bundle looks like.

The endpoint list confirms how loose the extraction was. It includes border.radius.circle, btn.glass, color.border.accent.orange and calls.function.arguments.delta, which are CSS property names and a streaming response key. above.sm and below.sm come from the same tokenizer. avatar.online is another. A list that reads avatar.online as a server is not a list of servers. The endpoints that hold up are app.wascript.com, which matches the vendor name in the extension title, and api.statsigcdn.com, a feature-flag SDK. The Atlassian domains in that list are documentation strings carried inside bundled libraries.

Two obfuscation findings: OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. A base64 block in a bundled file usually inlines an image or a font. Indirect function calls at line 1, column 0 are how webpack resolves modules. The combination that signals payload delivery is obfuscation sitting next to a malware signature in the same file. There are no malware signatures anywhere in this package, and the categories for secrets, dependencies and tool poisoning are all empty.

The strongest case against this verdict is the extension's function. WhaScale is a CRM layered on WhatsApp Web with 10,000 users. To do its job it reads conversations, and it syncs to app.wascript.com, so message content leaves the browser. Someone could argue that install consent does not cover that flow, and that WhatsApp automation tools carry account-ban risk whatever the scan says. Both are fair points. Neither is supported by a finding here. The code shows no attempt to reach cookie stores, no credential handling findings, and no signature of a known family. The recorded manifest lists no permissions and no host permissions, which is odd for something talking to a remote service and reads more like a collection gap than a real declaration.

If you want to dig further, the manifest entry and what sits inside the base64 block in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js are the two items worth opening by hand.

Key Reasons

• Zero malware signatures, secrets, dependency or tool-poisoning findings across 1,188 results
• All 22 network findings are HTTP client pattern matches (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) inside the same hashed minified vendor files
• Endpoint list contains CSS tokens border.radius.circle, btn.glass and color.border.accent.orange, showing IoC extractor noise
• Obfuscation findings are a base64 asset block and webpack module indirection at line 1 of minified files, with no signature in the same file
• Only credible endpoints are the vendor's own app.wascript.com and the Statsig feature-flag host

False Positive Considerations

• IoC extractor parsed CSS property values and streaming response keys as hostnames
• Bundled minified vendor JS triggering NET-* client patterns once per library file
• 754 code-smell rules firing on minified bundle code
• LARGE_BASE64 obfuscation rule matching inlined assets in a bundled marketing file

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 72%.