Pangeia

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Pangeia presents itself as a CRM tool for WhatsApp Web, and the code structure supports that claim. The extension uses Socket.IO for real-time communication (detected in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js and several other files), jQuery for AJAX requests (content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb224.js), and standard fetch API calls (content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2136.js). These are the same libraries any web application would use to sync data with a backend server.

The 22 network findings don't point to suspicious domains or data exfiltration. They flag the presence of networking APIs, which is expected for a CRM that needs to communicate with WhatsApp Web and its own backend. The background.js file also makes fetch calls, likely for license verification or settings sync. No malware signatures matched. No indicators of compromise pointed to known malicious infrastructure. The network_endpoints field is empty, meaning no specific suspicious domains were extracted.

Two obfuscation findings exist. The OBFUSCATION-LARGE_BASE64 finding in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js flags a large Base64 string. The OBFUSCATION-FUNCTION_INDIRECT finding in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js flags indirect function calls. Both patterns are common in bundled JavaScript. Modern build tools like webpack and esbuild produce code with Base64-encoded assets and minified function references. The file naming pattern (UUID-based filenames in assets/js/) matches typical build output, not hand-crafted obfuscation.

A skeptic might argue that the obfuscation findings combined with the low user count (79 users) warrant suspicion. The counterargument is that obfuscation without malware signatures or suspicious network endpoints is a weak signal. Malicious extensions typically combine obfuscation with data exfiltration to known-bad domains, credential harvesting patterns, or typosquatting of popular tools. Pangeia shows none of these. The extension has a clear description in Portuguese, a developer contact email ([email protected]), and a specific use case. The low user count reflects a niche product for Portuguese-speaking WhatsApp business users, not a red flag.

The findings here are artifacts of how modern JavaScript is built and deployed. The scanner detected networking libraries and bundled code patterns, then flagged them. Without malware signatures, suspicious domains, or deceptive naming, there's no evidence of malicious intent. The extension does what it claims: it's a CRM for WhatsApp Web that uses standard web technologies to function.

Key Reasons

• No malware signatures or indicators of compromise detected
• Network findings flag standard libraries (jQuery, Socket.IO, fetch) used by any modern web application
• Obfuscation findings match bundled/minified JavaScript patterns from build tools, not malicious obfuscation
• No suspicious domains or data exfiltration endpoints identified
• Extension has clear purpose, developer attribution, and matches its stated functionality

False Positive Considerations

• Standard networking library usage (jQuery, Socket.IO, fetch) triggering network findings
• Bundled/minified JavaScript with Base64 assets and indirect function calls triggering obfuscation findings
• UUID-based filenames in assets/js/ matching typical build tool output patterns

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 85%.