Waat: CRM e Vendas no WhatsApp Web

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension is a WhatsApp Web CRM. It injects content scripts into the WhatsApp page, layers lead and conversation tooling on top, and syncs that activity to its own backend at app.wascript.com. The package also loads the StatSig analytics SDK from api.statsigcdn.com. Nothing in the findings contradicts that description.

The 22 network findings are the plumbing a chat dashboard needs. NET-FETCH-background.js:137 shows the service worker issuing a fetch, which is how contact and message state leaves the page. NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js:1 and the same file at line 13, plus NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js:64 and NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289175.js:37, are Ajax and socket calls inside hashed build artifacts under content/assets/js/. Socket.io plus jQuery Ajax is the standard shape of a live inbox, and every one of these matches sits in a bundled file.

The endpoint list needs reading before it alarms anyone. It contains above.sm, below.sm, ae.jobs, ae.online, af.pf, btn.glass, chat.live and calls.function.arguments.delta. Those are dotted property chains, CSS shorthand and server-sent-event field names that the IoC extractor lifted out of minified JavaScript and printed as hostnames. One real host appears beyond the analytics SDK: app.wascript.com, the product's own API. There is no login domain, no paste site and no raw IP in the set.

Two obfuscation findings exist. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1 flags a base64 blob inside a hashed build asset. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1 flags indirect function invocation, which bundlers emit when they wrap module exports for lazy loading. The base64 blob is the one item worth a second look, since a build asset of that name could carry an inlined font, an inlined image or an embedded script.

Set against those, no malware signature matched during the scan, and no secret, dependency or tool-poisoning finding fired. The 755 code-smell entries and 414 IoC entries are the volume driving the total. Code-smell rules of this kind fire on any non-trivial JavaScript, and the IoC extractor's output here is dominated by substrings that were never addresses.

A skeptic would point at the publisher, an unnamed contact address at [email protected], at the small install base of seven users, and at that base64 blob in a directory called funnil, then ask whether this is a WhatsApp content script with a payload attached. That is a fair question. The evidence supports a quieter reading: both obfuscation hits are medium severity, both sit in build output, they appear alongside zero malware signatures and no non-product host, and a WhatsApp automation tool has ordinary reasons to ship a bundled backend client and inlined assets. The package carries only one manifest-analysis entry and no permission strings, so permission coverage is partial, and those empty lists are missing data.

Key Reasons

• Zero malware signatures, zero secrets and zero dependency findings across 1194 results; the load is 755 code-smell and 414 IoC entries typical of bundled JavaScript
• All 22 network findings are NET-FETCH, NET-JQUERY_AJAX or NET-SOCKET_IO inside hashed build files under content/assets/js/ and background.js:137, consistent with a chat client talking to its backend
• The endpoint list is dominated by extractor artifacts (border.radius.circle, calls.function.arguments.delta, above.sm, af.pf) rather than resolvable hosts; the only product host is app.wascript.com
• OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/...289260.js:1 is a standard bundler pattern, and the base64 blob in funnil/assets/js/...CgnacD38.js:1 sits with no accompanying malware signature
• No host permissions or permission strings are recorded and only one manifest-analysis entry exists, so permission data is partial rather than confirmatory

False Positive Considerations

• IoC extractor emitting CSS shorthand and property chains (border.radius.circle, calls.function.arguments.delta, btn.glass) as hostnames
• 755 code-smell findings from YARA rules that match routine JavaScript patterns in bundled files
• High finding count across hashed webpack-style build artifacts under content/assets/js/
• Obfuscation hits on ordinary bundler output and a base64 asset blob

Reviewed 2026-10-13; recommended action: monitor; model confidence 72%.