WAME

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WAME describes itself as a CRM for WhatsApp Web, and the code shipped in version 7.4.3.87 looks like the client half of that product. The scan returned 1,193 findings. The number worth starting with is zero: no malware signatures and no credential rules matched anywhere in the build. What remains is library fingerprints, bundler artifacts and extractor noise.

The network bucket holds 22 findings, and every one is a library pattern rather than evidence of hidden traffic. NET-JQUERY_AJAX fires at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js:13, NET-SOCKET_IO at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15, and NET-FETCH at background.js:137 plus a row of numbered chunks under content/assets/js/. A CRM that tracks WhatsApp conversations needs a persistent connection to a server and a way to make requests. Socket.io and fetch are the ordinary tools for that. The endpoint list backs this up. app.wascript.com is the only entry that matches the product, and it reads as the vendor's own API. The rest is what the extractor produced from minified code: border.radius.circle, btn.glass and color.border.accent.orange are CSS tokens read as hostnames, while api.atlassian.com and api.statsigcdn.com arrive inside bundled third-party libraries rather than from extension code.

Two obfuscation findings are flagged. OBFUSCATION-LARGE_BASE64 points at funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1, and OBFUSCATION-FUNCTION_INDIRECT at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1. Both are what a bundler leaves behind. Base64 blobs of that size are inlined fonts, images or source maps. Indirect function calls are how renamed module exports get resolved at runtime. The pattern that would justify alarm is an obfuscation finding sharing a file with a malware signature, and that does not happen in this build.

The bulk of the count is 754 code-smell findings and 414 IoCs. Code-smell rules match minified JavaScript as a category, which is why they carry low severity, and the IoC list is visibly contaminated by property chains and CSS class names lifted out of the bundle. Neither bucket identifies a behaviour. The manifest analysis produced a single finding and the permission arrays came back empty, so the extraction of declared access is thin.

The strongest counterargument is that any WhatsApp CRM sits on top of your conversations. Its content scripts run on WhatsApp pages and hold a socket.io connection, so message text passes through code the vendor controls and reaches app.wascript.com. If that traffic went to a domain unrelated to the product, or if secret and credential findings turned up beside the message handling, this verdict would flip. Neither is present. The endpoint matches the product name, the scan records no secret findings and no IoCs aimed at login pages, and the live connection is the feature working as advertised. A fresh manifest extraction would close the one gap.

Key Reasons

• Zero malware-signature, malware, secret and tool-poisoning findings across 1,193 results
• All 22 network findings match library patterns (jQuery AJAX, socket.io, fetch) inside content/assets/js/ and background.js
• The only product-relevant endpoint is app.wascript.com; remaining listed domains are CSS tokens or bundled Atlassian/Statsig CDNs
• Obfuscation flags are a base64 blob and function indirection, both typical bundler output with no co-located malware signature
• The extension is a WhatsApp Web CRM, so reading chat content and holding a live server connection is its stated function

False Positive Considerations

• IoC extractor read CSS tokens such as border.radius.circle and btn.glass as hostnames
• Network findings are library fingerprints (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) in bundled chunks
• 754 code-smell findings fired on minified bundle output
• Obfuscation flags (LARGE_BASE64, FUNCTION_INDIRECT) are standard webpack/esbuild artifacts

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 76%.