OMICall

AI Security Review

Evidence context: threat category none; evidence quality strong.

OMICall, developed by Vihat Software, is a VoIP integration tool designed to bring telephony features to various customer relationship management platforms. The extension's network endpoints map directly to legitimate business infrastructure. Connections to agent-v1-stg.omicrm.com, haravan.app, kiotviet.vn, and fnb.mysapo.vn align perfectly with the extension's stated purpose of integrating with Vietnamese e-commerce and CRM ecosystems. The extension declares no special host permissions in its manifest, meaning it relies on the websites you visit to load its interface rather than injecting code into every page. The absence of malware signatures and the lack of deceptive naming conventions point to a standard business utility.

The scanner generated 231 indicators of compromise and 92 code-smell alerts, but these are artifacts of bundled third-party dependencies. The network findings NET-FETCH-thirdparty/hubspot.js-1 and NET-FETCH-thirdparty/pancake.js-1 originate from scripts belonging to HubSpot and Pancake, both established marketing and analytics platforms. These SDKs naturally contain hundreds of internal tracking endpoints, pixel URLs, and API routes. The IoC extractor blindly catalogs every URL string it finds in these minified files, inflating the count without identifying actual malicious infrastructure. Code-smell rules trigger on basic Node.js patterns and standard API calls, which are expected in any modern web application.

The single high-severity obfuscation alert, OBFUSCATION-UNICODE_HEAVY-thirdparty/hubspot.js-1, requires similar context. Minified JavaScript from large enterprise platforms often uses dense variable names and unicode escape sequences to reduce file size. The scanner interprets this density as an attempt to hide code, but it is simply the output of a standard build pipeline. There are no dynamic payload loaders, no encrypted strings, and no evidence of steganography. The unicode characters are simply part of the minified code structure.

A skeptic might point to the high volume of findings and argue that the extension is using third-party scripts as a cover for data exfiltration. They would note that 231 IoCs is a massive number and demand proof that none of them are malicious. However, this argument ignores the specific domains involved. Every network endpoint in the bundle belongs to a known SaaS provider or the extension's own staging environment. There are no unknown domains, no suspicious IP addresses, and no data transmission to external logging servers. The code does exactly what the developer claims it does, and the scanner's noise is a well-documented limitation of analyzing bundled frontend dependencies.

Key Reasons

• Network endpoints map to legitimate Vietnamese CRM and e-commerce platforms like Haravan, Sapo, and KiotViet.
• Obfuscation and network findings originate from minified third-party SDKs for HubSpot and Pancake.
• Zero malware signatures or credential theft indicators.
• Developer is Vihat Software, the known publisher of the OMICall platform.
• High IoC count is a known false positive pattern caused by bundled frontend dependencies.

False Positive Considerations

• Bundled third-party SDKs (HubSpot, Pancake) containing hundreds of internal tracking URLs.
• Minified JavaScript triggering unicode-heavy obfuscation alerts.
• Code-smell rules matching standard API calls in modern web applications.

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 95%.