Smart WA

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Smart WA is a customer relationship management tool, likely focused on WhatsApp integration given the name and the presence of app.wascript.com in its network endpoints. Curiously, the extension declares no host permissions and no special permissions in its manifest. This means it cannot read or modify data on arbitrary websites, severely limiting its ability to act as a browser hijacker or credential stealer.

The scanner flagged 411 indicators of compromise, but a close look at the extracted network endpoints reveals they are almost entirely artifacts of the code rather than actual command-and-control servers. Domains like border.radius.circle, color.border.accent.orange, and calls.function.arguments.delta are CSS design tokens and JavaScript property access chains that the IoC extractor mistakenly parsed as web addresses. The legitimate network traffic routes to Atlassian infrastructure like api.dev.atlassian.com and atlassian-isolated.net, alongside Statsig at api.statsigcdn.com, which are standard analytics and development platforms.

The remaining bulk of the 1190 total findings comes from 754 low-severity code-smell matches. These are generic YARA rules that fire on standard JavaScript patterns found in bundled dependencies. The 22 network findings simply flag the use of standard web technologies like NET-SOCKET_IO, NET-JQUERY_AJAX, and NET-FETCH across various content scripts and background.js. There are exactly two obfuscation findings. One flags a large Base64 string in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, which is typical for embedded marketing funnel widgets or tracking pixels. The other flags indirect function calls in a content script. Neither is co-located with a malware signature.

A skeptic might point to the generic developer email at [email protected] and the low user count of 87 as signs of a fly-by-night operation building a malicious tool. They might argue that the Base64 obfuscation in the funnel script is hiding a payload. However, the complete absence of host permissions means the extension physically cannot exfiltrate browsing history or inject scripts into banking sites. Without the ability to read page content or intercept network requests across the web, a malicious payload would be entirely inert. The findings are a textbook example of scanner noise, not a hidden threat.

Key Reasons

• 411 IoC findings are dominated by CSS design tokens and property paths misidentified as domains
• 754 code-smell findings are low-severity YARA matches on standard JavaScript patterns
• Zero malware signatures or tool-poisoning indicators detected
• Extension declares no host or special permissions limiting its capability

False Positive Considerations

• IoC extractor misidentifying CSS variables and design tokens as domains
• Code-smell YARA rules matching standard bundled JavaScript
• Obfuscation rules triggering on minified marketing funnel scripts

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 85%.