G5 Chat - CRM, automações e ferramentas direto no seu WhatsApp.

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension presents as a WhatsApp Web CRM tool with Kanban boards, bulk messaging, and AI features. The findings bundle contains 1183 total items, but the nature of those findings tells a clear story when examined individually.

Zero malware signatures matched across the entire codebase. The 404 IoC findings are dominated by the XIOC extractor misreading CSS design tokens and JavaScript property chains as network domains. The network_endpoints list includes entries like border.radius.circle, color.border.accent.orange, calls.function.arguments.delta, and btn.glass. These are not domains. They are CSS custom property names and JavaScript object access patterns that the extractor parsed as hostnames. Legitimate services like api.statsigcdn.com (a feature flag platform) and Atlassian API endpoints appear alongside them, consistent with bundled third-party SDKs.

The 22 network findings are all generic API usage markers: NET-JQUERY_AJAX, NET-SOCKET_IO, and NET-FETCH in files under content/assets/js/ and background.js. These indicate the extension uses standard web APIs for communication, which is expected for a CRM that syncs data with a backend server. No suspicious external domains appear in these findings.

The two obfuscation findings require context. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js flags a large base64-encoded block, which commonly represents embedded fonts, image assets, or configuration data in bundled applications. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js matches indirect function call patterns that are standard output from JavaScript minifiers and bundlers like webpack or esbuild. Neither finding co-occurs with malware signatures.

The 754 code-smell findings are all low severity and match the documented noise patterns: generic code quality rules that fire on any non-trivial JavaScript application.

A skeptic might argue that the developer email [email protected] is generic and the low user count of 401 raises questions about legitimacy. The generic email is not ideal for trust verification, and the small user base means limited community scrutiny. However, absence of malware signatures is the strongest possible negative evidence for malicious intent. A CRM extension communicating with its backend via fetch and Socket.IO, bundled with third-party SDKs that trigger IoC false positives, matches the profile of a functional application with scanner noise, not a malicious payload. The findings volume is entirely explained by known false positive patterns: IoC extractor garbage on CSS properties, code-smell rules on bundled dependencies, and obfuscation detectors on minified output.

Key Reasons

• Zero malware signatures across entire codebase
• IoC findings are CSS design tokens and JavaScript property chains misread as domains
• Network findings are generic API usage patterns without suspicious destinations
• Obfuscation findings match minified/bundled code patterns, not malicious payloads
• Code-smell findings are documented noise patterns on bundled dependencies

False Positive Considerations

• IoC extractor misreading CSS design tokens and JavaScript property chains as domains
• Code-smell rules firing on bundled third-party dependencies
• Obfuscation detectors matching minified/bundled JavaScript output
• Generic network API usage patterns flagged without suspicious destination domains

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 92%.