waTidy : CRM no whatsapp, Automações e Ferramentas para venda

AI Security Review

Evidence context: threat category none; evidence quality moderate.

waTidy adds CRM features to WhatsApp Web: chat organisation, reply automation and sales tooling, according to its listing. The scan produced 779 findings, and they come from a very narrow set of sources. 754 of them are low-severity code-smell matches scattered across the minified JavaScript under content/assets/js/. Those rules fire on ordinary bundled code, anything that calls fetch or reads a config value or references a function indirectly, and they say nothing about intent.

The 22 network findings are library signatures rather than hard-coded destinations. NET-JQUERY_AJAX, NET-SOCKET_IO and NET-FETCH appear in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, ...12.js, ...149.js and ...175.js, and one fetch call sits at background.js:137. Socket.IO plus fetch, in a product whose job is keeping a sales pipeline in step with live chat, is the plumbing you would expect. What actually matters is where those sockets point, and the bundle names no endpoint at all. Nothing here identifies a destination domain.

The two remaining medium-severity items are obfuscation matches. OBFUSCATION-LARGE_BASE64 lands in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. A long base64 string inside a hash-named asset file is usually an embedded image, a font or serialised config. Indirect function calls are what every bundler emits once it minifies. Neither is a payload by itself.

What is missing carries as much weight as what is present. No malware signature matched, no IoC domain was extracted, no secret or API key was recovered, and no tool-poisoning rule fired. There is no name copying a well-known extension, no search-hijack URL template, and no credential pattern aimed at login pages. The publisher is reachable at [email protected], and the capability the code shows, reading and syncing WhatsApp Web conversations, is the capability the listing advertises. The recorded permission and host-permission lists for this version are empty, so exact host access cannot be confirmed from this data. That is a collection gap, not a finding against the extension.

A sceptic would raise two fair points. An extension that injects into WhatsApp Web can read every message a user sends, and this one holds open realtime socket connections. A large base64 blob in a randomly named file is also exactly how some droppers carry their payload. Both observations are correct. They just are not paired with any of the signals that would make them dangerous: no external domain, no key material, no packed loader, no history or new-tab manipulation. Confirming this cleanly would take two things, a decode of the base64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and the socket.io handshake target in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js. Everything available points to a bundled web app talking to its own backend.

Key Reasons

• Zero malware signatures, zero IoCs, zero secrets and zero tool-poisoning hits across 779 findings; 754 are low-severity code-smell matches from minified bundles.
• All 22 network findings are library-level signatures (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) in content/assets/js/ bundles and background.js:137, and no destination endpoint is named anywhere.
• The two obfuscation matches, OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_...260.js, fit embedded-asset and minifier output patterns.
• No impersonation, search-hijack template or credential-targeting pattern, and the publisher is contactable at [email protected] with a description matching the observed behaviour.
• Capability is consistent with the product: a WhatsApp Web CRM that reads chat content and syncs it over fetch and Socket.IO.

False Positive Considerations

• 754 low-severity code-smell findings generated by bundled and minified JavaScript libraries
• Network findings are framework signatures (jQuery AJAX, Socket.IO, fetch) rather than hard-coded suspicious domains
• OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT match embedded-asset and minifier output, not packed payloads
• Finding volume inflated by bundled dependencies under content/assets/js/ with no matching malware or IoC evidence

Reviewed 2026-10-13; recommended action: no action; model confidence 72%.