Zap Machine

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Zap Machine describes itself as a CRM for WhatsApp Web and reports 18 users on Chrome. Its bundled JavaScript carries the build string v_7_4_3_87_0a650f0a through a set of files under content/assets/js/, plus background.js and a folder called funnil/.

Every network finding is a library-usage match. background.js:137 triggers NET-FETCH, and the same rule fires across roughly a dozen content/assets/js/v_7_4_3_87_0a650f0a-*.js files. Six files trigger NET-SOCKET_IO, including content/assets/js/v_7_4_3_87_0a650f0a-...28912.js:15 and ...289149.js:64. Two trigger NET-JQUERY_AJAX, at content/assets/js/v_7_4_3_87_0a650f0a-...28923.js lines 1 and 13. Socket.IO and fetch are how a chat client stays in sync with a server; jQuery's ajax helper is how an older bundle makes the same calls. The scan recorded that these patterns exist. It recorded no destination for any of them.

The two obfuscation findings read the same way. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, a filename built from a UUID and a content hash, which is what a bundler writes when it inlines an asset into the output. OBFUSCATION-FUNCTION_INDIRECT fires on line 1 of content/assets/js/v_7_4_3_87_0a650f0a-...289260.js, the opening line of a minified file, where indirect function calls are ordinary compiler output. Neither rule reports what the payload does.

The rest of the scan found nothing. No identifiers of compromise, no malware signatures, no secrets, no dependency findings, no code-smell hits. The capture lists no declared permissions and no host permissions, which points to a gap in the scan: sorting chats inside a page requires access to that page.

A skeptic would point at three things. The permission data is empty, so the scan cannot show the extension's real scope. The file named funnil/assets/js/9cf42769-...CgnacD38.js wraps a large base64 block, and base64 is a common way to smuggle a payload. The publisher is an email address at extensao.store rather than a named company, with 18 users. None of that is wrong, and none of it is behavioral evidence either. The flags present are rules that fire on any bundled JavaScript, and not one of them names a recipient, a domain, or a credential source. Nothing in the file set shows cookie, storage, or login-form access. What would settle the question is one runtime observation: the address the Socket.IO client in content/assets/js/v_7_4_3_87_0a650f0a-...28912.js connects to. That address is not in this evidence, so the flags describe the shape of the code rather than intent.

Key Reasons

• All 22 network findings are library-usage rules (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) in content/assets/js and background.js:137, with no endpoint or domain recorded
• Both obfuscation findings match minified/bundled output: LARGE_BASE64 in a content-hashed file funnil/assets/js/9cf42769-...CgnacD38.js and FUNCTION_INDIRECT on line 1 of content/assets/js/...289260.js
• Zero ioc, malware-signature, malware, secret, dependency and code-smell findings in the entire file set
• Socket.IO, fetch and jQuery ajax are the expected transport for a chat synchronisation extension, matching the stated WhatsApp Web CRM function
• No permission or host-permission strings were captured, leaving the extension's declared scope unverified

False Positive Considerations

• Network library rules (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) matching ordinary bundled client code across many content/assets/js files
• LARGE_BASE64 rule matching inlined assets in a build-hashed filename under funnil/assets/js
• FUNCTION_INDIRECT rule matching minified compiler output on line 1 of content/assets/js/...289260.js
• Scan gap on manifest permissions inflating apparent risk for an extension whose job requires page access

Reviewed 2026-10-15; recommended action: suppress false positive; model confidence 72%.