Vluw

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Vluw extension describes itself as a CRM for Google Chrome, published by [email protected] with 24 users at version 7.4.3.85. The scanner flagged 24 findings, all at medium severity: 21 network activity detections and 2 obfuscation markers. Zero malware signatures matched. Zero indicators of compromise were extracted. No suspicious domains appear in the network endpoint list.

Every network finding is a generic framework call. Three NET-FETCH detections in background.js at lines 52, 63, and 137 are standard HTTP requests from the extension's service worker. The remaining 18 network findings are split between NET-SOCKET_IO, NET-FETCH, and NET-JQUERY_AJAX calls inside content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920*.js files. These file names follow the pattern of a versioned web application bundle, likely generated by a build tool like webpack or Vite. Socket.io and jQuery AJAX are ubiquitous in CRM dashboards that maintain real-time connections to a backend server. None of these findings name a specific external domain. The network_endpoints array is empty, meaning the scanner extracted no URLs to evaluate.

The two obfuscation findings sit in bundled asset directories. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920253.js and OBFUSCATION-LARGE_BASE64 in funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js are characteristic of minified or compiled JavaScript. The funnil directory name points to a sales funnel module within the CRM. Build tools routinely produce output that triggers indirect function call and large base64 string rules. These are code-quality markers, not evidence of payload hiding.

The extension declares zero permissions and zero host permissions. A CRM that cannot access web page content, cannot read browser history, and cannot make cross-origin requests has a sharply limited attack surface. It can only operate within its own extension pages.

A skeptic might point to the low user count, the generic developer email, and the typo in the description as signs of a hastily assembled or disposable extension. Those are fair observations. Low quality and malicious intent are different things. The scanner found no malware signatures, no credential harvesting patterns, no suspicious domains, and no impersonation of a known product. The findings that do exist are explained by standard web application bundling. Until a finding names a real external domain or a malware signature matches, the evidence points to a small, niche CRM tool with noisy scanner output.

Key Reasons

• Zero malware signatures and zero IoCs detected across all scanned files
• All 21 network findings are generic framework calls (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) with no suspicious destination domains
• Both obfuscation findings (OBFUSCATION-FUNCTION_INDIRECT, OBFUSCATION-LARGE_BASE64) reside in bundled asset directories typical of compiled web applications
• Extension declares no permissions and no host permissions, limiting its capability to access user data or other websites
• Network endpoints array is empty, confirming no specific suspicious domains were extracted from the code

False Positive Considerations

• Generic NET-FETCH, NET-SOCKET_IO, and NET-JQUERY_AJAX findings fire on any standard web framework HTTP activity regardless of destination
• OBFUSCATION-FUNCTION_INDIRECT and OBFUSCATION-LARGE_BASE64 rules trigger on minified and bundled JavaScript output from build tools like webpack or Vite
• High finding count (24) is driven entirely by network and obfuscation categories with zero malware-signature or IoC corroboration
• Bundled asset files in content/assets/js/ and funnil/assets/js/ contain compiled CRM application code that naturally triggers code-quality rules

Reviewed 2026-10-09; recommended action: suppress false positive; model confidence 82%.