PROSPECTA CRM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

PROSPECTA CRM is a tool designed to organize WhatsApp Web chats. The codebase includes real-time communication libraries, specifically Socket.IO and jQuery, which generate the bulk of the network findings in files like content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf692012.js. These network calls are standard for a CRM widget that needs to sync data with a backend server, such as app.wascript.com, a known WhatsApp automation platform.

The scanner flagged 423 indicators of compromise, but a closer look at the extracted network endpoints reveals they are almost entirely fabricated by the extraction tool. Entries like color.border.accent.orange, border.radius.circle, btn.glass, and calls.function.arguments.delta are not internet domains. They are CSS-in-JS styling properties and JavaScript object access chains that the scanner mistakenly parsed as URLs. Similarly, the Atlassian domains like api.dev.atlassian.com likely stem from a bundled third-party dependency or an integration feature, not malicious command-and-control traffic.

The two obfuscation findings are also benign. The OBFUSCATION-FUNCTION_INDIRECT flag in content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920253.js triggers on indirect function calls, which are a standard output of modern JavaScript bundlers. The OBFUSCATION-LARGE_BASE64 finding in funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js points to a large base64 string, which is typically used to embed fonts, icons, or small images directly into the code to reduce HTTP requests. Furthermore, the 730 code-smell findings are low-severity noise that fire on any non-trivial JavaScript application. The code-smell rules triggering here are broad patterns that match basic frontend framework structures, such as environment variable access or standard fetch calls. When you combine a modern frontend framework with a real-time backend, you naturally generate hundreds of these low-level pattern matches.

A skeptic might point to the empty permissions array and the generic developer email [email protected] as signs of a hastily assembled or deceptive extension. It is true that a WhatsApp CRM usually requires host permissions to interact with web.whatsapp.com, and the absence of these in the manifest is unusual. However, the actual behavior of the extension, confirmed by the presence of Wascript endpoints and standard CRM UI libraries, aligns perfectly with its description. The missing permissions are likely a manifest parsing artifact or a quirk of how the extension injects its scripts, rather than evidence of hidden malicious intent. There are zero malware signatures, no credential harvesting logic, and no typosquatting of known brands.

Key Reasons

• IoC extractor misidentified CSS-in-JS properties like color.border.accent.orange as network domains
• Obfuscation flags triggered on standard Webpack indirect function calls and embedded base64 assets
• Network findings map to legitimate CRM backend infrastructure like app.wascript.com and standard Socket.IO libraries
• Zero malware signatures or credential harvesting logic present in the codebase

False Positive Considerations

• IoC extractor parsing CSS-in-JS and object chains as domains
• YARA code-smell rules matching standard frontend framework patterns
• Obfuscation rules triggering on minified bundle output

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 92%.