ZappyGO

AI Security Review

Evidence context: threat category none; evidence quality weak.

The extension ZappyGO describes itself as a CRM for WhatsApp Web, aimed at organizing chats and optimizing business operations. The extracted code contains files in content/assets/js/ and funnil/assets/js/, along with a background.js script. The scanner flagged several network and obfuscation findings across these files.

The network findings, such as NET-FETCH-background.js-137 and multiple NET-SOCKET_IO and NET-JQUERY_AJAX markers in the content scripts, simply indicate that the extension uses standard web APIs to communicate with its backend services. Socket.io and jQuery are common libraries for real-time CRM features like chat synchronization. The scanner did not extract any suspicious network endpoints or indicators of compromise. The network endpoints array is empty, meaning the extension does not contact known malicious domains or unrecognized third-party trackers.

The obfuscation findings include OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. While obfuscation can sometimes hide malicious payloads, in this context it is isolated from any malware signatures or suspicious data exfiltration logic. Commercial extensions frequently obfuscate their source code to protect intellectual property, and bundled dependencies often trigger these same markers. The presence of large base64 strings and indirect function calls is a standard characteristic of minified or protected JavaScript.

A skeptic might argue that the developer attribution, listed only as a generic email address [email protected], combined with the obfuscation and a relatively low user count of 212, paints a picture of an anonymous developer hiding malicious intent. Anonymous publishers with obfuscated code warrant scrutiny. However, the scanner found zero malware signatures, zero credential theft indicators, and zero suspicious IoCs. If this extension were stealing WhatsApp sessions or injecting ads, we would see specific network endpoints targeting authentication cookies or known ad domains. The complete absence of these markers, combined with the lack of extracted host permissions, means the code does not demonstrate the capabilities required to execute the attacks a skeptic might fear.

Ultimately, the findings are artifacts of standard web development practices. The extension uses common networking libraries and employs basic code protection. Without any corroborating evidence of malicious behavior, such as suspicious domains or malware signatures, the scanner flags are noise. The extension operates within the bounds of a standard CRM tool, and the current evidence does not support a malicious classification.

Key Reasons

• Network findings only indicate standard API usage like fetch and socket.io
• Obfuscation markers are isolated from any malware signatures or data exfiltration logic
• No suspicious network endpoints or indicators of compromise were extracted
• The extension lacks host permissions that would enable broad data collection

False Positive Considerations

• Network findings are standard API calls (fetch, socket.io) without suspicious domains
• Obfuscation in bundled or protected JavaScript is common for commercial IP protection
• No malware signatures or suspicious IoCs are present in the extracted code

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 75%.