Sender Up: Automações para WhatsApp Web, dê um Up nas suas vendas!

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Sender Up is a Chrome extension that adds CRM and sales automation to WhatsApp Web. Version 7.4.3.84, published by [email protected], with 157 users. The scan returned 754 findings, and nearly all of them are noise.

730 of the 754 come from low-severity code-smell rules. Those fire on minified library code: the content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1... files are versioned bundle chunks, and webpack or esbuild output trips dozens of checks for eval-shaped patterns, weak randomness and env-var reads without any of it being malicious. The scan also recorded zero malware signatures, zero IoC entries, zero secret findings and zero tool-poisoning hits. Nothing in this bundle matches a known malware family.

The 21 network findings are NET-FETCH and NET-JQUERY_AJAX calls in background.js at lines 52, 63 and 137 and across the bundle chunks, plus NET-SOCKET_IO in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js:15. A persistent socket channel and fetch calls are what a WhatsApp inbox tool needs: it has to push incoming messages into a side panel and pull contact records from its own backend. jQuery AJAX is the bundled library doing what jQuery does. No finding names a destination, and no IoC list was extracted, so there is no evidence about where the traffic goes beyond the extension's stated service.

The two obfuscation findings sit in minified chunks: OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js and OBFUSCATION-LARGE_BASE64 in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js. Indirect function calls are how bundlers avoid name collisions between modules, and a large base64 blob in an asset file is usually an inlined font, icon set or source map. Randomized-looking filenames like CdHxSFqr are content-hash cache busting, not concealment.

The strongest counterargument is that WhatsApp automation is a grey area. These tools read the chat list through a content script, which means access to customers' private conversations, and a Socket.IO client could ship that text off-device. That is a real capability and worth naming plainly. What would overturn this verdict is a captured endpoint list showing conversation content leaving to a domain unrelated to the vendor, or a cookie and credential access finding tied to WhatsApp Web. Neither shows up here: no secret findings, no credential access, no suspicious domain in any indicator. The live risk is contractual and reputational, since WhatsApp bans bulk senders, rather than evidence of malicious code.

Key Reasons

• Zero malware-signature, IoC, secret and tool-poisoning findings across the whole scan
• 730 of 754 findings are low-severity code-smell rules that fire on any minified bundle
• Network findings are NET-FETCH/NET-SOCKET_IO/NET-JQUERY_AJAX calls in background.js and versioned bundle chunks, matching a live CRM backend plus bundled jQuery
• Both obfuscation flags (OBFUSCATION-FUNCTION_INDIRECT, OBFUSCATION-LARGE_BASE64) sit in minified webpack-style chunks and asset files, consistent with bundler output rather than deliberate concealment
• No captured endpoint list or suspicious domain, so nothing ties the extension to a hostile destination

False Positive Considerations

• Code-smell rules firing on minified bundle chunks under content/assets/js/
• Library-level network calls (jQuery AJAX, fetch, Socket.IO) counted as medium-severity network findings
• Bundler artifacts flagged as obfuscation (indirect calls, base64-inlined asset with a content-hash filename)
• High overall finding count driven by volume of low-severity rules rather than by malicious code

Reviewed 2026-09-26; recommended action: suppress false positive; model confidence 78%.