Zapbase

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Zapbase is a Chrome Web Store extension that adds CRM features to WhatsApp Web. Version 7.4.3.87 ships a content bundle under content/assets/js/ plus a background script, and the analysis produced 1202 findings. What matters is their nature.

The network findings describe APIs, not recipients. All 22 are type markers: NET-FETCH, NET-SOCKET_IO and NET-JQUERY_AJAX, spread across the content/assets/js/v_7_4_3_87_0a650f0a-*.js files and background.js:137. None names a destination. A socket.io connection in a WhatsApp dashboard is how incoming messages reach the UI without polling, and fetch calls are how a web app talks to its backend. A real-time channel is a property of the product category.

The IoC list is mostly not domains. Among the 423 entries, the visible ones include border.radius.circle, btn.glass, color.border.accent.orange, below.sm, artboard.phone and calls.function.arguments.delta. Those are CSS class names, design-token identifiers and a streaming API field name. The extractor reads any dotted token as a hostname. The plausible real hosts in the same list are the vendor backend app.wascript.com, the feature-flag and analytics host api.statsigcdn.com, and a group of Atlassian cloud hostnames (api.stg.atlassian.com, api.atlassian-us-gov-mod.com) that sit next to Atlassian design tokens in the same code, which points at a bundled UI dependency.

The obfuscation hits match a minified build. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, a file named with a UUID and a build hash. Embedded base64 in a hashed build artifact is routine for fonts, icons and inline JSON. OBFUSCATION-FUNCTION_INDIRECT on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js describes webpack-style module dispatch. Neither is paired with a malware signature, and neither file carries an external destination.

Nothing else fired. Zero malware-signature findings, zero secret findings, zero dependency findings, zero tool-poisoning findings. The other 754 entries are low-severity code-smell rules that match ordinary JavaScript. The permission and host-permission lists came back empty, which is hard to reconcile with an add-on that has to run inside WhatsApp Web, so that reads as a gap in how the manifest was parsed.

The counterargument. A WhatsApp CRM reads every message in the account it is installed on. With 37 users and a publisher identified only as [email protected], a skeptic would say the socket.io channel that keeps the dashboard in sync could carry the same chat text outward, and a static read cannot tell the difference. That concern is real, and a capture of the socket payload is what would settle it. It does not change what the code shows now: no malware signature, no credential or cookie handling, and no endpoint beyond the vendor's own host and standard analytics.

Of 1202 findings, 1177 are low-severity code-smell and IoC noise, and the 22 network hits name APIs rather than destinations.

Key Reasons

• Zero malware-signature and zero malware findings across 1202 results, with no secret or dependency findings either
• All 22 network findings (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) are API-usage markers in content/assets/js/v_7_4_3_87_0a650f0a-*.js and background.js, naming no destination
• The 423 IoC entries include obvious non-domains such as btn.glass, border.radius.circle, below.sm and calls.function.arguments.delta
• The two obfuscation hits are OBFUSCATION-LARGE_BASE64 in a hash-named bundle file and OBFUSCATION-FUNCTION_INDIRECT, both standard minified-build patterns
• 754 of 1202 findings are low-severity code-smell rules that fire on ordinary bundled JavaScript

False Positive Considerations

• IoC extractor read CSS class names, design tokens and an OpenAI streaming field name as hostnames (btn.glass, border.radius.circle, calls.function.arguments.delta)
• 754 low-severity code-smell rules matching generic JavaScript patterns in bundled content/assets/js files
• Network findings record API usage (fetch, socket.io, jQuery Ajax) without identifying a recipient
• Obfuscation rules firing on minified bundler output: an embedded base64 asset and indirect function dispatch

Reviewed 2026-10-12; recommended action: monitor; model confidence 72%.