CRM-PRO : CRM no whatsapp, Automações e Ferramentas para venda

AI Security Review

Evidence context: threat category none; evidence quality moderate.

CRM-PRO is a Chrome extension for managing WhatsApp Web conversations, listed under the contact address [email protected] with about two dozen users. The scan returned 751 findings, and 729 of them are code-smell matches. Those rules fire on ordinary JavaScript: a fetch call, a crypto import, a variable named key. They carry low severity and describe code shape rather than intent, so they cannot carry a verdict on their own.

The findings that do describe behavior sit in two places. background.js lines 52, 63 and 137 each make a network fetch. The content bundle content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js line 15 opens a Socket.IO connection, and neighboring chunks in the same v_7_4_3_84_... set make plain fetches and jQuery AJAX calls, for example ...121.js lines 1 and 13 or ...125.js line 8. A CRM that syncs WhatsApp threads has to hold a live channel to a backend, and a socket plus AJAX is the ordinary way to build that. No endpoint domain is recorded anywhere in this scan, so there is nothing to compare against a threat list. Nothing here names a credential target, a search-hijack domain, or an ad network, and there are no malware signatures, IoCs or secrets.

Two obfuscation matches need naming. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js line 1, and OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js line 1. Hashed filenames and single-line files are what webpack, Vite and esbuild emit. The v_7_4_3_84 folder prefix matches the version the store lists (7.4.3.84), which is how a versioned web client ships its chunks. Large base64 blobs inside those bundles are usually embedded icons, fonts or source maps, not concealed payloads. Neither obfuscation match sits in the same file as a malware signature, which is the combination that would matter.

A skeptic would point at the target itself. WhatsApp Web is where private conversations live, and this scan shows a persistent Socket.IO connection plus fetch calls, so a hostile build of this extension could stream message text to a server. That risk is real and applies to every WhatsApp integration, but the scan produced no evidence for it in this build. The counterargument also has a gap worth flagging: the permission and host-permission arrays came back empty, which for a content-script extension looks like an extraction miss rather than a genuinely permission-free add-on. That gap is why this is a scanner-noise verdict and not a clean bill of health.

What drives the total is volume, not behavior. A code-quality rule firing 729 times across bundled vendor and app chunks tells you the bundle is large, not that the extension misbehaves. Strip the code-smell noise and what remains is a chat client talking to its own backend through fetch, socket and AJAX calls.

Key Reasons

• 729 of 751 findings are low-severity code-smell matches that fire on any non-trivial JavaScript and carry no behavioral meaning
• Network findings are fetch, Socket.IO and jQuery AJAX calls in background.js and build-hashed content bundles, consistent with a chat client syncing to its own backend
• Zero malware signatures, zero IoCs and zero secret findings across the entire scan
• Both obfuscation flags land on single-line files with content-hash names (funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js, content/assets/js/v_7_4_3_84_...1254.js), the output shape of webpack/Vite bundling
• No impersonation signals: the name and Portuguese description match an independent WhatsApp CRM tool, not a clone of a popular extension

False Positive Considerations

• Bundled and minified web-app JavaScript under content/assets/js triggering code-smell, network and obfuscation heuristics at once
• 729 code-smell matches inflating the total finding count without describing actual behavior
• Obfuscation heuristics firing on single-line, build-hashed bundle files rather than on packed payloads
• Empty permission, host-permission and endpoint arrays, so no domain data exists to verify or refute backend traffic

Reviewed 2026-09-27; recommended action: suppress false positive; model confidence 72%.