BS Business: Automações para WhatsApp Web

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension BS Business: Automações para WhatsApp Web presents a collection of network and obfuscation findings that require careful parsing to separate standard web application behavior from actual threats. The codebase contains 21 network findings, primarily concentrated in background.js and the content/assets/js/ directory. Specific markers like NET-FETCH-background.js-52, NET-SOCKET_IO-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js, and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1121.js-1 show that the extension relies heavily on fetch requests, Socket.IO connections, and jQuery AJAX calls. For a CRM tool designed to organize WhatsApp Web chats and automate business workflows, establishing persistent connections to a backend server is an expected operational requirement. These network markers do not point to known malicious domains or suspicious infrastructure.

The obfuscation findings are limited to two specific instances. The marker OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js-1 flags indirect function calls, a common pattern in minified JavaScript where variable names are shortened and function references are passed around. The second marker, OBFUSCATION-LARGE_BASE64-funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js, identifies large base64 strings inside a directory named funnil. The funnil path strongly indicates this file belongs to a third-party marketing, analytics, or funnel-tracking script bundled with the extension, rather than a custom obfuscated payload written by the developer to hide malicious logic.

A skeptic might look at the generic developer email [email protected], the zero user count, and the presence of base64 encoded strings in a vaguely named directory, and conclude the extension is a hastily assembled wrapper designed to inject tracking scripts or harvest WhatsApp session data. This is a valid concern for any WhatsApp automation tool, as the platform frequently bans unauthorized API usage and malicious actors often use these tools to steal sessions. However, the evidence lacks the hallmarks of session theft or credential harvesting. There are zero malware signatures, zero IoCs targeting login domains, and no code-smell findings related to cookie extraction. The network endpoints are generic fetch and socket operations without specific malicious URLs attached.

Ultimately, the findings reflect the noisy reality of scanning modern JavaScript applications. The scanner tripped over standard networking libraries and a bundled third-party marketing script. Without specific indicators of data exfiltration, credential theft, or deceptive impersonation, the extension operates within the bounds of a typical, albeit lightly documented, business automation tool.

Key Reasons

• Network markers reflect standard CRM backend communication via fetch and Socket.IO
• Obfuscation findings are limited to minified JS patterns and a third-party marketing script
• Zero malware signatures, IoCs, or credential theft indicators present
• Generic developer email and zero user count are typical for niche regional business tools

False Positive Considerations

• Bundled third-party marketing scripts in funnil directory
• Standard minified JavaScript triggering indirect function obfuscation rules
• Generic network markers for fetch and Socket.IO without malicious domains

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 85%.