YOUSELLER - Facilidade, produtividade em escala.

AI Security Review

Evidence context: threat category none; evidence quality moderate.

YOUSELLER is a Chrome extension that layers CRM features onto WhatsApp Web: chat organization, contact tagging, funnel tracking. It ships a large set of bundled content scripts under content/assets/js/, plus a background.js, and talks to a backend over Socket.IO and fetch.

The 22 network findings are generic API-usage matches, not evidence of data going to a specific place. NET-SOCKET_IO at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15 and ...149.js:64 record that the Socket.IO client library is loaded. NET-FETCH at background.js:137 records a fetch call in the background script. NET-JQUERY_AJAX at ...23.js:13 records jQuery's ajax helper. A chat CRM that keeps a live connection to a server and pulls contact lists uses exactly these APIs. None of the findings names a destination host, and the endpoint list itself is unreliable: border.radius.circle, calls.function.arguments.delta, btn.glass, artboard.phone, below.sm and avatar.online are CSS values and JavaScript property chains that the extractor read as domains. api.statsigcdn.com is Statsig's feature-flag CDN, an ordinary SaaS dependency.

The two obfuscation entries are minification artifacts. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1 flags a base64 blob, the common way build tooling inlines fonts or images. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1 matches the dynamic dispatch shape that webpack and rollup emit. Neither file carries a malware signature, and zero malware and zero malware-signature findings appear across the whole set. The remaining volume, 754 code-smell hits and 457 IoCs, is what any bundled extension looks like to string-matching rules.

A skeptic would point at two things. First, the manifest that was captured declares no permissions and no host permissions, which is odd for an extension whose job is to read WhatsApp Web; without the real manifest there is nothing to check the code's scope against. Second, app.wascript.com is the one endpoint that looks like a vendor service and it does not match the YOUSELLER name. If that host is the CRM backend, the picture is ordinary. If it were a third party collecting conversation text, that would matter a great deal. What would settle it is the resolved destination of the fetch in background.js and the actual manifest permissions. Neither is in this data, which is why confidence sits at 0.72 rather than higher. Everything present describes a normally bundled web app.

There is no browser hijack here (no search or new-tab override in the findings), no credential-targeting code, no proxy or relay, and no impersonation of a known extension. The findings table is long because the extension is large, not because it behaves badly.

Key Reasons

• Zero malware and zero malware-signature findings across 1,236 entries; the two obfuscation hits are a base64 build artifact and webpack dynamic dispatch
• All 22 network findings are generic API-usage matches (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) in bundled content scripts and background.js:137, with no destination host recorded
• The endpoint list is polluted with CSS values and JS property chains read as domains (border.radius.circle, calls.function.arguments.delta, btn.glass, below.sm), leaving only api.statsigcdn.com and app.wascript.com as plausible services
• Socket.IO and fetch are expected for a WhatsApp Web CRM that syncs chats in real time
• No hijack, credential, proxyware or typosquatting indicators; description and store listing match the extension's actual behavior

False Positive Considerations

• Generic network pattern rules firing on every fetch, Socket.IO and jQuery ajax call in the bundle
• IoC extractor reading CSS values and minified JavaScript property chains as domain names
• 754 code-smell hits generated by large minified content script bundles
• Base64 blob and webpack dynamic dispatch misclassified as obfuscation

Reviewed 2026-10-12; recommended action: suppress false positive; model confidence 72%.