AtendaZap

AI Security Review

Evidence context: threat category none; evidence quality strong.

AtendaZap describes itself as a CRM for Google Chrome, specifically targeting WhatsApp integrations. The extension declares no special permissions and no host permissions in its manifest, limiting its baseline capability to interact with the browser environment. The developer is listed as [email protected]. With only 35 users, this is a highly niche tool.

The scanner flagged 405 indicators of compromise and 22 network findings. However, a review of the extracted network endpoints reveals classic extractor noise. Domains like border.radius.circle, color.border.accent.orange, and calls.function.arguments.delta are clearly CSS variables and JavaScript function arguments misidentified as URLs by the IoC parser. The actual network traffic observed in files like background.js and the versioned content/assets/js/ scripts relies on standard web libraries, specifically jQuery AJAX, native Fetch, and Socket.IO. The few legitimate endpoints present, such as app.wascript.com and various api.atlassian.com subdomains, align perfectly with a CRM tool integrating with WhatsApp and project management services.

The bulk of the 1,185 total findings come from 755 low-severity code-smell matches. These rules trigger on basic JavaScript patterns found in any non-trivial application and carry no security weight. The two medium-severity obfuscation findings also lack malicious context. The OBFUSCATION-LARGE_BASE64 match in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js points to a funnel asset likely containing encoded images or fonts, while OBFUSCATION-FUNCTION_INDIRECT in the content script is a standard artifact of modern JavaScript bundlers like webpack or esbuild. There are zero malware signatures present in the codebase.

The extension architecture relies heavily on content scripts, as seen in the numerous content/assets/js/v_7_4_3_86 files. These files are heavily versioned, indicating a build process that hashes assets for cache busting. The Socket.IO and Fetch calls within these files are standard mechanisms for a CRM to maintain real-time synchronization with a backend server, such as receiving new WhatsApp messages. The Atlassian API endpoints suggest the CRM might also sync tasks or contacts with Jira or Trello.

A skeptic might argue that the complete absence of declared permissions combined with a generic developer email and low user count makes this a suspicious, fly-by-night operation. It is true that an extension claiming to be a CRM without host permissions is functionally limited, which might indicate an incomplete or poorly configured build rather than a malicious one. However, the lack of permissions actually reduces the risk profile significantly. Without host permissions or activeTab, the extension cannot silently read data from arbitrary websites or inject scripts into banking portals. The findings driving the risk score are entirely attributable to scanner noise, not hidden malicious capabilities.

Key Reasons

• 405 IoC findings are predominantly garbage extracted from CSS variables and JS function calls
• 755 code-smell findings are low-severity noise typical of bundled JavaScript
• Zero malware signatures or malicious network endpoints identified
• Obfuscation findings are standard minification artifacts in bundled assets
• Legitimate network endpoints like app.wascript.com align with the stated WhatsApp CRM functionality

False Positive Considerations

• IoC extractor parsing CSS variables and JS function calls as domains
• Code-smell rules triggering on bundled JavaScript
• Obfuscation rules flagging standard minification artifacts and base64 assets

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 85%.