WATSELY

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension WATSELY describes itself as a customer relationship management tool for WhatsApp Web. An examination of the code reveals a modern JavaScript application built with a module bundler, which explains the structure of the files and the nature of the scanner findings. The 22 network findings do not point to suspicious external domains. Instead, they are detections of standard web APIs like fetch, Socket.IO, and jQuery AJAX scattered across numerous chunked JavaScript files in the content/assets/js/ directory. Files named with version strings and UUIDs, such as v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js, are the hallmark of tools like Webpack or Rollup splitting an application into smaller loadable pieces. When a scanner searches for network activity, it simply finds these standard API calls in every chunk where they are used.

The two obfuscation findings follow the same pattern of benign build artifacts. The OBFUSCATION-FUNCTION_INDIRECT match in content/assets/js/v_7_4_3_87_...260.js is a classic false positive triggered by minified code, where bundlers compress variable names and function calls into indirect references to save space. The OBFUSCATION-LARGE_BASE64 match in funnil/assets/js/...CgnacD38.js points to an embedded base64 string. In the context of a CRM interface, this is almost certainly an embedded font, image, or UI template rather than a hidden payload. This is reinforced by the complete absence of malware signatures or suspicious indicators of compromise anywhere in the codebase.

A skeptic might point out that the developer, [email protected], uses a generic domain name and that the extension has zero recorded users. They might argue that a CRM for WhatsApp Web requires deep access to browser tabs and messaging data, making any network activity inherently risky. They could also note that the extension declares no explicit host permissions, which is unusual for a tool that needs to interact with a specific website. However, the evidence does not support malicious intent. The scanner extracted zero specific network endpoints or indicators of compromise. The network findings are purely structural, flagging the presence of fetch and Socket.IO without identifying where the data is actually going. If this extension were exfiltrating WhatsApp messages or injecting ads, we would see specific external domains in the network endpoints or malware signatures in the code. The complete absence of such indicators, combined with the clear footprint of a standard JavaScript build pipeline, means the findings are just noise from the scanner.

Key Reasons

• Network findings only detect standard API usage (fetch, Socket.IO, jQuery AJAX) in bundled chunk files.
• No specific suspicious domains or IoCs were extracted from the code.
• Obfuscation findings match minified code and embedded base64 assets, common in modern build pipelines.
• Zero malware signatures or code-smell findings associated with malicious behavior.

False Positive Considerations

• Bundled JavaScript chunks triggering network API detections
• Minified code triggering indirect function obfuscation rules
• Embedded base64 assets triggering large base64 obfuscation rules

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 85%.