DR.FIDELIZA

AI Security Review

Evidence context: threat category none; evidence quality moderate.

DR.FIDELIZA is a Portuguese-language CRM extension for Chrome, listed with contact address [email protected]. The name does not mimic a known extension and the typo in the listing's word "Chorme" is a language slip. Typosquatting is not in play here.

The capability picture settles most of this. The manifest declares no permissions and no host permissions, which limits what the service worker can send to third-party origins. The code on top of that is a modern JavaScript bundle: hashed files under content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289*.js plus a funnil/assets/js tree, the naming you get from webpack or esbuild output.

The 22 network findings are library patterns. NET-FETCH-background.js-137 marks a fetch call in the background service worker. NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js-1 marks jQuery's ajax helper. NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js-15 marks a socket.io client. A CRM that syncs contacts and runs a support chat contains all three.

The endpoint list shows how noisy extraction is. Entries such as border.radius.circle, btn.glass, color.border.accent.orange, artboard.phone and calls.function.arguments.delta are CSS declarations and JSON key paths that were read as hostnames. The resolvable hosts are api.atlassian.com and api.statsigcdn.com, for project tracking and feature flags, plus app.wascript.com, a WhatsApp Business API service. For a Brazilian CRM, Jira and WhatsApp are ordinary integrations, not exfiltration infrastructure.

No malware signature matched. No secret, dependency or tool-poisoning finding was recorded. The 754 code-smell results and 425 indicator hits come from minified third-party code, which is where those rules always fire. The two obfuscation results follow the same shape: OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Bundlers emit indirect function calls routinely, and base64 blocks that size in a bundle are usually inlined fonts, icons or source maps.

A skeptic would push back on two things. The publisher is reachable only through a generic contact address, and the base64 block in CgnacD38.js is large enough to hide a payload. Static scanning does not decode blobs, so that file is the one open question and decoding it is the check that would close it. Everything else points away from harm: no cookie or credential access rule fired, no login domain appears anywhere in the findings, and the manifest grants no host permissions, so the background worker at background.js:137 has no route to ship data to a third-party origin. A manifest requesting broad host access would change this review.

The scanner is reacting to bundled library code and to property chains that look like domains, both of which are documented noise sources. The extension's own code shows no harmful behavior to match.

Key Reasons

• Zero malware signatures and zero critical or high severity findings across 1204 results
• All 22 network findings are library patterns (NET-FETCH, NET-JQUERY_AJAX, NET-SOCKET_IO) inside hashed bundle files, with no explicit suspicious endpoint
• Listed endpoints are CSS design tokens plus known infrastructure (api.atlassian.com, api.statsigcdn.com, app.wascript.com), not exfiltration hosts
• Extension declares no permissions and no host permissions, which limits what background.js:137 can transmit off-origin
• Both obfuscation hits (LARGE_BASE64, FUNCTION_INDIRECT) sit in minified build output, consistent with bundler artifacts

False Positive Considerations

• IoCo extractor parsing CSS declarations and property chains as domains (color.border.accent.orange, border.radius.circle, btn.glass)
• 754 code-smell hits generated by minified bundled JavaScript under content/assets/js and funnil/assets/js
• Network rules firing on generic library presence (fetch, jQuery ajax, socket.io) rather than on named endpoints
• OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT matching standard bundler output

Reviewed 2026-10-12; recommended action: suppress false positive; model confidence 72%.