LEEVO CRM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

LEEVO CRM presents itself as a customer relationship management tool for Chrome. The extension manifest declares zero permissions and zero host permissions, which severely limits its ability to interact with other websites or access sensitive browser data. The developer is listed as [email protected], and the extension has a very small user base of 26 individuals. This limited scope and small footprint align with a niche business tool rather than a mass-market malicious campaign.

The automated analysis generated 1161 findings, yet a detailed review of the evidence reveals a complete absence of malicious intent. There are zero malware signatures and zero tool-poisoning indicators. The 730 code-smell findings are all low severity and represent standard JavaScript patterns found in any modern web application. The 407 IoC findings are heavily polluted with false positives. The extracted network endpoints include obvious scanner errors such as color.border.accent.orange, border.radius.circle, and calls.function.arguments.delta. These strings are CSS variables and JavaScript property chains pulled directly from the source code, completely misinterpreted as domain names by the extraction tool.

The legitimate network traffic observed in the bundle routes to expected infrastructure. Files like background.js and the various scripts in content/assets/js/ make fetch and Socket.IO requests to app.wascript.com and api.atlassian-us-gov-mod.com. These domains align with the stated purpose of a CRM tool syncing data with external services. The two medium-severity obfuscation findings, specifically OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920253.js and OBFUSCATION-LARGE_BASE64 in funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js, point to bundled third-party dependencies. Base64 encoding and indirect function calls are standard techniques used by minifiers and build tools to reduce file size and protect intellectual property in commercial software.

A skeptic might point to the 21 medium-severity network findings and the two obfuscation alerts as evidence of data exfiltration or hidden payloads. They would argue that an extension with no declared permissions should not be making this many external requests or hiding encoded strings. However, the specific file paths tell a different story. The network requests originate from standard jQuery AJAX and Socket.IO implementations within the content scripts, which are required for the CRM interface to communicate with its backend. The obfuscated files reside in a funnil/assets directory, a common naming convention for bundled frontend assets in commercial web applications. Without any malware signatures, without any suspicious external domains outside of the developer's known infrastructure, and without the permissions necessary to steal data, these findings reflect normal application architecture rather than malicious behavior.

Key Reasons

• Zero malware signatures or tool-poisoning indicators present in the bundle
• 407 IoC findings are heavily polluted with CSS variables and JS property chains misidentified as domains
• Extension declares zero permissions and zero host permissions, limiting its attack surface
• Obfuscation findings trace to standard minified third-party dependencies in funnil/assets directory

False Positive Considerations

• IoC extractor misidentifying CSS variables like color.border.accent.orange as network domains
• Code-smell rules triggering on standard JavaScript patterns in bundled dependencies
• Obfuscation rules flagging standard base64 encoding in minified third-party libraries

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 85%.