WaClinic

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WaClinic describes itself as a CRM for WhatsApp Web, and its file layout matches that job. There is a background.js, a content/assets/js/ tree of versioned bundles, and a second bundle directory called funnil/assets/js/. Version 7.4.3.87 ships on the Chrome Web Store to about 21 users under the developer address [email protected].

The scanner produced 1,204 findings. None of them are malware. That number is the first thing to understand: 754 are code-smell hits, the kind that fire on any minified bundle, and 425 are indicator-of-compromise extractions. The endpoint list shows why the second number carries no weight here. Alongside two real hosts, app.wascript.com and api.statsigcdn.com, the extractor lists border.radius.circle, color.border.accent.orange, btn.glass, above.sm, ae.jobs and calls.function.arguments.delta. Those are JavaScript property chains and design-token names, not domains anyone can connect to.

The 22 network findings tell the same story. Each one is a generic library detection: NET-JQUERY_AJAX, NET-SOCKET_IO and NET-FETCH, spread across content/assets/js/v_7_4_3_87_*.js and one instance in background.js:137. Socket.IO and fetch are what a chat tool uses to keep a WhatsApp session in sync with a server. jQuery's AJAX helper is bundled into thousands of store extensions. Nothing in those findings names an unknown host or an outbound data sink.

Two obfuscation findings exist. OBFUSCATION-LARGE_BASE64 sits in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/...260.js. A large base64 blob inside a bundled asset is normally an inlined image, font or source map. Indirect function calls are how bundlers and module loaders operate. Neither coincides with a malware signature, and this scan matched none.

The strongest case against this verdict is the publisher. [email protected] is an email address rather than a company, and 21 installs is small enough that nobody has stress-tested the extension in public. Add an opaque filename like 9cf42769-...CgnacD38.js and a reader has fair reason to ask who is behind it. That doubt is aimed at the publisher, though, and the code itself shows nothing: no exfiltration target, no credential-harvesting pattern, no matched malware rule, no exposed secrets. A thin trust signal does not turn library detections into harmful behavior.

What would change the picture: a permission request that does not fit a chat CRM, a network finding pointing at a host outside app.wascript.com or a standard analytics provider, or a malware signature co-located with one of those two obfuscation hits in the same file. None of that is in this scan.

Key Reasons

• Zero malware signatures and zero secret findings across 1,204 total findings.
• All 22 network findings are generic library detections (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) in content/assets/js/v_7_4_3_87_*.js and background.js:137, with no named external host.
• The endpoint list mixes two real hosts (app.wascript.com, its own backend, and api.statsigcdn.com, a feature-flag service) with property-chain and CSS-token artifacts such as border.radius.circle and btn.glass.
• Both obfuscation findings are common bundler artifacts: a large base64 blob in funnil/assets/js/9cf42769-...CgnacD38.js and an indirect function call in content/assets/js/...260.js.
• Stated purpose (WhatsApp Web CRM) matches the file layout of content scripts plus a background service worker, with no category mismatch.

False Positive Considerations

• IoC extractor misreading JavaScript property chains and CSS design tokens (border.radius.circle, color.border.accent.orange, btn.glass, above.sm) as network domains.
• Generic library network rules (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) firing on bundled jQuery, Socket.IO and fetch calls in content scripts and background.js.
• 754 code-smell findings and 425 IoC extractions with no malware signatures, inflating volume without adding evidence.
• LARGE_BASE64 and FUNCTION_INDIRECT patterns flagging minified or asset-embedded third-party bundle output.

Reviewed 2026-10-15; recommended action: suppress false positive; model confidence 75%.