W10X

AI Security Review

Evidence context: threat category none; evidence quality moderate.

W10X describes itself as a CRM for WhatsApp Web, published under [email protected] at version 7.4.3.87, with around 102 users. The scan returned 1205 findings, and almost none of them describe behavior a WhatsApp CRM would not need. There are no malware signatures and nothing in the malware category at all.

The largest block, 754 low-severity hits, is code-smell noise generated by the minified bundles under content/assets/js/. Those files carry build hashes (v_7_4_3_87_0a650f0a-...js), which is what webpack or esbuild output looks like. Rules that fire on any non-trivial JavaScript record the presence of code, nothing more.

The 426 IoC entries collapse on inspection. The endpoint list contains "border.radius.circle", "color.border.accent.orange", "btn.glass" and "artboard.phone", which are design-token and CSS property strings lifted out of bundled stylesheets. "calls.function.arguments.delta" is an OpenAI streaming event name. The recognizable hosts are api.statsigcdn.com (feature flags) and the Atlassian API hosts (api.dev.atlassian.com), both of which arrive with third-party libraries. The one host that lines up with the vendor's brand is app.wascript.com.

The 22 network findings are library fingerprints. NET-JQUERY_AJAX, NET-SOCKET_IO and NET-FETCH fire across content/assets/js/v_7_4_3_87_0a650f0a-...js and on background.js:137 because jQuery's ajax helper, the socket.io client and fetch sit inside the bundle. A dashboard that mirrors WhatsApp chats needs all three. None of those findings names an endpoint, a payload or a scheduled beacon.

The two obfuscation findings need the same reading. OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_87_0a650f0a-...289260.js, which is minifier output where functions are invoked through variables. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, a webpack chunk whose filename is a content hash. Long base64 strings in chunk files are normally inlined fonts, icons or wasm. Neither finding sits next to a malware signature, because no file in this bundle produced one. The manifest side is thin: the scan recorded no permission strings, which for a content-script extension that has to run on web.whatsapp.com is an extraction gap rather than a real declaration.

A skeptic would point out that a WhatsApp CRM reads private messages and talks to app.wascript.com over socket.io. If that endpoint were a relay, the shape would match spyware. That is the strongest version of the case against W10X and it deserves stating plainly. It does not carry the verdict because no finding documents that traffic: the socket.io and fetch hits are pattern matches on bundled client libraries, there is no command-and-control domain, no credential rule hit, no cookie-access finding, and no malware signature in 1205 results. What would settle it is a runtime capture of the socket.io handshake to app.wascript.com and a decode of the base64 blob in the funnil chunk.

Key Reasons

• Zero malware-signature and zero malware-category findings across 1205 total results.
• The 426 IoC entries are CSS and design-token strings such as border.radius.circle and btn.glass misread as hostnames.
• The 22 network findings are library pattern matches (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) inside hashed webpack bundles, not identified destinations.
• Both obfuscation findings (FUNCTION_INDIRECT, LARGE_BASE64) are consistent with minifier output and an inlined asset in a content-hashed chunk.
• Socket.io and fetch usage matches the stated function of a WhatsApp Web CRM.

False Positive Considerations

• IoC extractor misread CSS/design-token strings (border.radius.circle, btn.glass, color.border.accent.orange) as domains
• 754 low-severity code-smell hits generated by minified bundle files under content/assets/js/
• Network findings are library fingerprints (NET-JQUERY_AJAX, NET-SOCKET_IO) in hashed build output
• OBFUSCATION-LARGE_BASE64 fires on an inlined asset in a webpack chunk named with a content hash

Reviewed 2026-10-12; recommended action: monitor; model confidence 72%.