Talk Mais

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Talk Mais presents itself as a CRM layered on top of WhatsApp Web, and the files in the extension match that description. The scan produced 1,200 entries sorting into three buckets: 421 indicator entries, 754 code-style warnings, and 24 hits across the network, obfuscation and manifest categories. The scan matched zero malware signatures and zero malware rules. Nothing in the credential, dependency, secret or tool-poisoning categories fired either.

The 22 network findings are usage detections rather than destinations. Titles such as NET-FETCH-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2260.js-1 and NET-SOCKET_IO-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2148.js-64 record that a file calls fetch, opens a Socket.IO connection, or issues a jQuery AJAX request. Those calls sit in version-stamped, hashed files under content/assets/js/, which is the shape of a webpack build. A CRM that syncs conversations with a server needs all three.

The endpoint list is where the extraction visibly drifts. border.radius.circle, color.border.accent.orange, btn.glass and calls.function.arguments.delta are CSS design tokens and streaming API field names that were lifted out of source text and recorded as hosts. The same is true of above.sm, below.sm, ae.jobs, af.pf, be.audio, avatar.online, artboard.phone and chat.live. The hosts that resolve to something real are api.statsigcdn.com, a feature-flag and analytics service used across the industry, and app.wascript.com, which fits a WhatsApp automation backend. The atlassian.com and atlassian-isolated.net entries arrive alongside the design-token strings, so they come out of the same bundled style data.

Two obfuscation findings exist. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js is a webpack module-wrapping pattern. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js is a base64 block in a file named for a funnel feature. A blob that size usually carries an embedded image, font or bundled library. It is the one finding a closer look would settle, and it sits beside zero malware matches.

The strongest argument against reading this as scanner noise is volume: 1,200 entries on an extension with 29 users and a developer contact that is just an email address, [email protected]. Volume is the weakest form of evidence. The 421 indicator entries and 754 code-style warnings come from the two categories that fire on minified JavaScript regardless of what the code does. Strip those out and what remains is a webpack bundle making ordinary network calls, referencing a design system, and shipping a base64 asset. A re-scan that captures the manifest match patterns would close the one gap left by the empty permission arrays.

To change this reading you would need a finding that ties code to a destination: a fetch or socket call aimed at a host unrelated to WhatsApp, chat sync or analytics. No such call shows up in the 22 network hits or in the endpoint list.

Key Reasons

• Zero malware and zero malware-signature findings; the 1,200 entries are 421 IoC and 754 code-smell, the two categories known to fire on any non-trivial JavaScript bundle
• All 22 network findings are generic usage detections (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) inside version-stamped hashed webpack chunks under content/assets/js/
• Endpoint list consists of CSS design tokens and JSON field names misread as hosts (border.radius.circle, color.border.accent.orange, btn.glass, calls.function.arguments.delta), plus Statsig analytics and app.wascript.com, a WhatsApp-as-a-Service backend
• Only obfuscation hits are a base64 asset block in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js and a webpack module-wrap pattern in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js
• Extension behaviour matches its stated purpose: content scripts and background fetch calls consistent with a WhatsApp Web CRM

False Positive Considerations

• IoC extractor reading CSS design tokens and JSON field names as domains
• 754 code-smell warnings generated by bundled minified JavaScript
• Network findings are framework usage detections (fetch, socket.io, jQuery AJAX) rather than named destinations
• 421 IoC entries with no corresponding malware or malware-signature finding

Reviewed 2026-10-10; recommended action: no action; model confidence 80%.