Acelere CRM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Acelere CRM is a version 7.4.3.86 Chrome extension published under the developer address [email protected], with 35 users. Its manifest declares no permissions and no host permissions. The scan returned 23 findings, all medium severity: 22 network pattern matches and 2 obfuscation matches, plus a single manifest entry carrying no description. There are zero IoC entries, zero malware signature matches, zero secret detections and zero code-smell hits.

The network findings are extractor matches on standard browser API calls inside the extension's bundled JavaScript. NET-FETCH-background.js-137 marks a fetch() call in background.js, the service worker. NET-SOCKET_IO-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js-15 and the same pattern at content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2148.js-64 mark a socket.io client. NET-JQUERY_AJAX-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb223.js-13 marks a jQuery ajax call. A CRM extension that keeps a contact list in sync with a server needs all three: a background fetch, a websocket for live updates, and ajax for form submissions. The file names follow the pattern v_7_4_3_86_ followed by a UUID, which is build tooling output.

The two obfuscation findings match the same picture. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js. Base64 blocks of that size are routine in bundler output where fonts, images or source maps get inlined. OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js:1, where calls go through variables rather than fixed names. Minifiers emit that whenever they rename top-level functions and keep a module registry.

A skeptic would argue that an extension making fetch and socket.io calls while declaring no host permissions has something to hide, and that a base64 blob in a file with a random name is concealment. The first point has a limit: this scan extracted no endpoint strings at all, and a hardcoded command-and-control domain would land in the IoC bucket, which is empty. The second point cuts the other way, since a payload hidden in base64 usually drags a malware signature along with it, and none matched.

What I cannot resolve from this evidence is the funnil directory. Every other path sits under content/assets/js or next to background.js; funnil appears once, in the base64 finding. That is worth a look in the source, but one oddly named directory does not outweigh an empty malware, IoC, secret and code-smell record across an extension whose declared surface is nothing.

The pattern here is a small commercial tool that compiles its front end the way every modern web app does, and a scanner that counts the artifacts of that compilation.

Key Reasons

• All 23 findings are medium severity pattern matches: 22 on fetch/ajax/socket.io calls in bundled files such as content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js and background.js:137, and 2 on minifier artifacts
• Zero IoC matches, so no command-and-control or exfiltration domain was extracted from the code
• Zero malware signature, secret and code-smell detections across the whole extension
• Manifest declares no permissions and no host permissions, leaving no privileged API surface to abuse
• Filenames such as v_7_4_3_86_.js indicate bundler output rather than hand-written or packed code

False Positive Considerations

• Network extractor matching ordinary fetch(), jQuery ajax and socket.io client calls in bundled JavaScript
• OBFUSCATION-LARGE_BASE64 firing on an inlined base64 asset in a hashed build file
• OBFUSCATION-FUNCTION_INDIRECT firing on minifier output that renames functions and uses a module registry
• Per-file pattern counting across dozens of separately hashed bundle chunks inflates the finding total

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 70%.