WAFACIL

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WAFACIL describes itself as a CRM layer for WhatsApp Web, and the files in this scan support that description. The content script bundle under content/assets/js/ carries Socket.IO and jQuery ajax code, which is ordinary plumbing for a tool that watches a chat window and syncs conversation state to a server. Version 7.4.3.86, 141 users, developer contact [email protected].

Of the 1,202 findings, none are malware. The malware-signature and malware buckets are both empty. What is left splits into 754 code-quality hits, 423 IoCs and 22 network detections, and all three groups come from the same source: minified bundled JavaScript in content/assets/js/ and background.js.

The network detections are library classifications, not destinations. NET-SOCKET_IO fires on v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2148.js and ...174.js, NET-JQUERY_AJAX fires on ...223.js, and NET-FETCH fires on background.js:137 plus a string of numbered bundles. Each of these rules identifies a library present inside the file.

The endpoint list is where the noise is easiest to see. Entries such as border.radius.circle, calls.function.arguments.delta, btn.glass, below.sm and artboard.phone are property access chains the extractor read as hostnames. The domains that do exist are app.wascript.com, which fits a WhatsApp automation product, and api.statsigcdn.com, a feature-flag service. The api.atlassian.com entries point at links inside a bundled dependency. There is no login domain, no banking host, and no unexplained command-and-control address anywhere in the list.

Two obfuscation findings need a direct answer. OBFUSCATION-LARGE_BASE64 on funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js flags an asset stored as a base64 string, which bundlers do routinely. OBFUSCATION-FUNCTION_INDIRECT on content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js flags a call made through a variable rather than a literal, which webpack and rollup output does constantly. Neither finding sits in the same file as a malware match, which is the combination that would matter.

The strongest argument against treating this as scanner noise is the access itself. A CRM for WhatsApp reads private conversations, and the scanned manifest lists no permissions and no host permissions, so the bundle alone does not tell us what the extension is allowed to touch. An extension that watches messages and posts them to app.wascript.com has the reach to cause real harm. That is a property of the product category, and it is the reason the residual doubt here is about data handling rather than about the code. What we can inspect behaves like an integration doing its stated job: library network calls, one bundled base64 asset, and a thousand hits from rules that fire on any large JavaScript bundle. Capturing runtime traffic to app.wascript.com and reading the manifest's content script matches would settle the remaining question.

Key Reasons

• Zero malware signatures and zero malware detections across 1,202 findings; every hit is code-smell, IoC or library-pattern network rules
• Network detections are library classifications (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) inside bundled content scripts, not contacts with suspicious hosts
• Endpoint list is dominated by IoC fragments (border.radius.circle, calls.function.arguments.delta, btn.glass) alongside app.wascript.com and api.statsigcdn.com
• Extension behavior (reading WhatsApp Web conversations and syncing to a backend) matches its stated CRM purpose
• Two obfuscation hits sit in minified bundled assets (funnil/assets/js/ed6113f2-...DCssQ7AT.js base64, content/assets/js/v_...259.js indirect call) with no co-located malware match

False Positive Considerations

• 423 IoC entries largely made of property-chain fragments misread as domains
• 754 code-smell rules firing on minified bundled JavaScript in content/assets/js/
• 22 network findings that are library-presence matches from jQuery, Socket.IO and fetch wrappers
• Bundled dependency links (api.atlassian.com, api.dev.atlassian.com) counted as network endpoints

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 72%.