Verk - Direto no whatsapp, Automações e IA para vendas

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension presents a classic false positive profile driven by IoC extractor noise and code-smell rule over-matching. The evidence shows zero malware signatures matched across all scanned files. The 410 IoC findings are dominated by design tokens and CSS properties misidentified as network domains. The network_endpoints list includes entries like border.radius.circle, color.border.accent.orange, btn.glass, and calls.function.arguments.delta. These are clearly UI framework tokens from a design system, not actual network destinations. The legitimate endpoints in the bundle are api.atlassian-us-gov-mod.com, api.stg.atlassian.com, and app.wascript.com, which represent Atlassian integration APIs and what appears to be the extension's own backend service.

The 22 network findings all reference standard web APIs: NET-JQUERY_AJAX, NET-SOCKET_IO, and NET-FETCH in files under content/assets/js/ and background.js. Socket.IO usage is expected for a WhatsApp automation tool that needs real-time message synchronization. The file naming pattern v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289*.js indicates versioned, bundled output from a build tool, not manually obfuscated malware.

The two obfuscation findings are OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in a versioned content script. Large base64 blocks in bundled assets are common for embedded fonts, images, or configuration data. Function indirection is a standard output pattern from JavaScript minifiers like Terser or esbuild. Without malware signatures co-located with these patterns, they don't indicate malicious intent.

The 754 code-smell findings are all low severity and represent the expected noise from bundled npm dependencies. A skeptic might argue that 1189 total findings indicate something is wrong. However, finding count alone is meaningless when the nature of those findings is demonstrably benign. The extension declares no host permissions and no special permissions, which is unusual but not inherently suspicious for a content script approach. The developer [email protected] is not a known brand, but the extension has a clear Portuguese-language description matching its stated purpose of WhatsApp sales automation. No typosquatting or impersonation of known extensions is present.

Key Reasons

• Zero malware signatures matched across all files
• 410 IoCs dominated by CSS design tokens misidentified as domains (border.radius.circle, color.border.accent.orange)
• Network findings reference standard web APIs (Socket.IO, fetch, jQuery AJAX) in bundled code
• Obfuscation findings are in minified build output without co-located malware signatures
• 754 code-smell findings are all low severity from bundled dependencies

False Positive Considerations

• IoC extractor misidentifying CSS design tokens as network domains
• Code-smell rules firing on bundled npm dependencies
• Obfuscation rules matching minified build output
• Network findings referencing standard web APIs in bundled code

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 85%.