KENVIA - Transforme o seu WhatsApp Web numa plataforma de vendas

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension, "KENVIA - Transforme o seu WhatsApp Web numa plataforma de vendas," is a Portuguese-language tool that helps sales teams organize WhatsApp Web messages and manage leads. The developer is listed as [email protected], and the extension has 6 users on the Chrome Web Store.

The scanner flagged 1,190 findings across this extension, but the nature of those findings tells a clear story. Zero malware signatures matched. Zero malware detections. The 411 indicators of compromise are almost entirely false positives generated by the IoC extractor misreading CSS design tokens and JavaScript property chains as domain names. Entries like border.radius.circle, color.border.accent.orange, and calls.function.arguments.delta in the network endpoints list are not real domains. They are CSS properties and function argument references from bundled frontend code. The Atlassian API endpoints (api.dev.atlassian.com, api.stg.atlassian.com) come from bundled third-party dependencies rather than the extension's own infrastructure.

The 22 network findings all reference standard web APIs. Files like content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js trigger NET-JQUERY_AJAX and NET-SOCKET_IO detections because they use jQuery and Socket.IO, which are common JavaScript libraries. The NET-FETCH findings in background.js:137 and various content scripts reflect normal HTTP requests to the extension's own backend at app.wascript.com, which aligns with the extension's stated purpose of syncing WhatsApp Web data.

The 754 code-smell findings are all low severity and fire on standard JavaScript patterns in bundled dependencies. These rules match basic Node.js patterns like fetch, exec, and crypto references that appear in virtually any non-trivial JavaScript application.

Two obfuscation findings warrant a closer look. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js flags a large base64 blob. The directory name "funnil" is likely a misspelling of "funnel," consistent with the extension's sales funnel functionality. Large base64 strings commonly encode embedded fonts, images, or configuration templates. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js detects indirect function calls, which are a standard output pattern of JavaScript minifiers like esbuild and webpack.

A skeptic would point to the extension's 6-user count and generic developer email as signs of a throwaway account used to distribute malware. That is a fair concern. New malicious extensions often launch with zero or single-digit user counts before being reported. However, malicious extensions at that stage typically show concrete evidence of harm: credential-harvesting code, connections to known-bad domains, or malware signatures in their payload. This extension shows none of those things. The finding volume is entirely explained by the IoC extractor misreading CSS tokens as domains and code-smell rules firing on bundled libraries.

The extension's actual behavior, as revealed by the code, is consistent with its description. It uses Socket.IO and fetch to communicate with app.wascript.com, processes WhatsApp Web DOM elements through content scripts, and bundles standard frontend libraries. There is no evidence of credential theft, browser hijacking, or data exfiltration to suspicious domains.

Key Reasons

• Zero malware signatures or malware detections in the entire codebase
• 411 IoC findings are CSS design tokens (border.radius.circle, color.border.accent.orange) and JS property chains misread as domains
• 754 code-smell findings are all low severity and match standard bundled JavaScript patterns
• 22 network findings reference standard web APIs (Socket.IO, jQuery AJAX, fetch) communicating with the extension's own backend at app.wascript.com
• 2 obfuscation findings are explained by embedded base64 assets in a sales funnel directory and standard minifier output

False Positive Considerations

• IoC extractor misreading CSS design tokens as domain names
• Code-smell rules firing on bundled frontend dependencies
• JavaScript property access chains misidentified as network endpoints
• Standard minifier output flagged as obfuscation

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 78%.