Whats Expert

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Whats Expert is a CRM layer for WhatsApp Web, published in version 7.4.3.87 by the developer address [email protected]. The scan returned 1196 findings, and the two categories carrying that count are code-smell (754) and IoC (417). Both are documented noise sources. There are zero malware signatures, zero tool-poisoning detections and zero exposed secrets. Nothing in the bundle shows cookie access, a login domain in the target list, or a dropper pattern.

The network findings resolve to library detections inside bundled content scripts: NET-SOCKET_IO at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15, NET-JQUERY_AJAX at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js:1, and a NET-FETCH in background.js:137. Socket.IO and jQuery are exactly what a live chat dashboard uses to stay in sync with a backend. The endpoint list is where the score came from, and it is mostly junk: design-token strings like border.radius.circle, color.border.accent.orange and btn.glass, plus property chains such as calls.function.arguments.delta and artboard.phone. Those are substrings pulled out of minified JavaScript. The entries that look like deliberate destinations are app.wascript.com, the vendor's own service host, and api.statsigcdn.com, a feature-flag CDN used by a long list of commercial products.

Two obfuscation findings fired. OBFUSCATION-FUNCTION_INDIRECT on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1 is what a bundler does to modules it has minified. The second, OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1, deserves naming because a hash-named script holding a large encoded blob is the shape a payload takes. No malware signature sits in that file, and blobs of that size are routine for inlined fonts, icon sprites and bundled assets.

A skeptic would push back on two points. First, the bundle records no permissions and no host permissions, which is odd for something that has to read WhatsApp conversations to work at all. That gap probably means the extractor missed the manifest entries, so treat the permission picture as unknown rather than clean. Second, the developer is an email alias with no company behind it, and the extension's whole job requires access to private chats. That is a genuine thing to weigh. Neither point turns any finding into evidence of harm. They mean the trust decision rests on the publisher's conduct, not on anything this code scan surfaced.

What the scan does establish is a minified, bundle-heavy codebase from a niche vendor, filtered through tooling that counts substrings. The IoC pile-up and the code-smell total match that pattern. Nothing in the code itself points to deliberate harm.

Key Reasons

• Zero malware signatures, zero tool-poisoning findings and zero secrets across 1196 total findings
• Network findings are library detections (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) inside bundled content/assets/js files and background.js, consistent with a live chat dashboard
• The 417 IoCs resolve to design tokens and property chains (border.radius.circle, calls.function.arguments.delta), not hosts
• OBFUSCATION-FUNCTION_INDIRECT on a minified module bundle is bundler output, and the large base64 blob carries no co-located malware signature
• No cookie access, no login domains, no proxyware or relay code in the target list

False Positive Considerations

• IoC extractor misreading CSS token names and JS property chains as domains (border.radius.circle, btn.glass, calls.function.arguments.delta, artboard.phone)
• 754 code-smell findings generated by bundled/minified vendor JavaScript
• High finding volume concentrated in dist-style bundled asset directories (content/assets/js, funnil/assets/js)
• Obfuscation heuristics firing on standard bundler output (function indirection) and on a base64 asset blob

Reviewed 2026-10-13; recommended action: no action; model confidence 70%.