MARKETING DE FITNESS

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension 'MARKETING DE FITNESS' describes itself as a CRM for WhatsApp Web, written in Portuguese. It's published by [email protected] and has 319 users. The most striking feature of this extension is what it doesn't have: zero host permissions and zero regular permissions. A CRM that claims to organize WhatsApp Web chats would need host permissions for web.whatsapp.com to interact with the page. The absence of any permissions means this extension cannot access WhatsApp Web at all, which raises questions about whether it functions as described. The findings total 1,189, but the nature of these findings tells a different story than the raw count. Zero malware signatures matched. Zero malware findings. The 754 code-smell findings are low-severity detections that fire on any non-trivial JavaScript, particularly bundled applications. The 410 IoC findings come from the same bundled code in content/assets/js/ files, where hundreds of npm dependencies each contribute their own domain references. This is the classic bundled-dependency false positive pattern. The 22 network findings are all detections of standard web APIs. Files like content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js trigger NET-JQUERY_AJAX detections, while others trigger NET-FETCH and NET-SOCKET_IO. These aren't connections to suspicious domains. They're the scanner detecting that the code uses fetch(), jQuery.ajax(), and Socket.IO, which are standard JavaScript libraries for making network requests. The two obfuscation findings are medium severity. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js detected a large base64 string, which is common in bundled or compiled applications. OBFUSCATION-FUNCTION_INDIRECT in a content script detected indirect function calls, which is typical output from JavaScript minifiers and bundlers. The network endpoints list includes app.wascript.com, which is a WhatsApp automation platform, and various Atlassian API endpoints (api.dev.atlassian.com, api.stg.atlassian.com). Many of the other endpoints like border.radius.circle, btn.glass, and color.border.accent.orange are CSS design token names, not actual network destinations. These are extracted from bundled CSS frameworks and don't represent real connections. A skeptic might argue that the missing permissions combined with the generic developer email and low user count indicates a hastily assembled malicious extension. But malicious extensions that target WhatsApp users typically request extensive permissions to access web.whatsapp.com and inject code into the page. This extension requests nothing, which makes it either non-functional or a placeholder. The absence of malware signatures and the nature of the findings point to a bundled web application that triggered scanner false positives, not a threat.

Key Reasons

• Zero malware signatures and zero malware findings despite 1,189 total findings
• 754 code-smell findings are low-severity noise from bundled JavaScript dependencies
• 410 IoC findings come from npm packages in content/assets/js/ files, not suspicious domains
• 22 network findings detect standard API usage (fetch, jQuery, Socket.IO), not malicious connections
• Extension declares no permissions, making it non-functional for its claimed WhatsApp Web CRM purpose

False Positive Considerations

• Bundled npm dependencies in content/assets/js/ generating 410 IoC findings
• 754 code-smell findings from low-severity YARA rules matching standard JavaScript patterns
• Network findings detecting standard API usage (fetch, jQuery, Socket.IO) rather than suspicious domains
• CSS design token names (border.radius.circle, btn.glass) misidentified as network endpoints

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 78%.