CRM DE ELITE : CRM no whatsapp, Automações e Ferramentas para venda

AI Security Review

Evidence context: threat category none; evidence quality moderate.

CRM DE ELITE is a WhatsApp Web CRM published under the developer contact [email protected], listed on the Chrome Web Store at version 7.4.3.87 with 212 users. The scan produced 1201 findings and not one of them is a malware signature: the malware-signature and malware buckets are both empty, as are the secret and dependency buckets. What is left is 422 generic indicators, 754 code-quality matches, and a small set of network and obfuscation findings, all of which sit inside bundled JavaScript under content/assets/js/ and funnil/assets/js/.

The network findings name detection patterns rather than hosts. NET-SOCKET_IO fires in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28966.js, NET-JQUERY_AJAX fires in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, and a single NET-FETCH fires in background.js. A CRM that organizes WhatsApp chats has to sync with a backend, so a socket connection and fetch calls are the product working as described. The endpoint list attached to those findings is largely parser debris: entries such as border.radius.circle, btn.glass, color.border.accent.orange and calls.function.arguments.delta are CSS token names and property-access chains misread as domains. The two entries that resolve to real services, api.statsigcdn.com and app.wascript.com, are a feature-flag CDN and the vendor's own automation backend.

Two obfuscation findings are recorded. OBFUSCATION-LARGE_BASE64 points at funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT points at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. The second is what minification does to every function call in a webpack-style bundle, a category already documented as a false-positive source. A large base64 literal in an asset file usually carries an embedded image, icon set or font, and no malware rule fired on that file.

A skeptic would point at the empty permission and host_permissions arrays and read them as a failed manifest parse. A content script that rewrites WhatsApp Web cannot run without host access to web.whatsapp.com, so this scan did not see the full manifest, and that caps how much weight the clean result can carry. The gap is missing data rather than a suspicious capability, though, and a hidden permission would still need to surface somewhere among the network and code-smell findings to count against the extension. The strongest concrete signal remains the base64 block in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and without its decoded contents there is no way to say what it holds. What would move this to a follow-up is a decoded payload, or a network destination that is not the vendor's own service.

Key Reasons

• Zero malware-signature and zero malware matches across 1201 findings; code-smell and IoC volume (754 and 422) accounts for almost all of it.
• Network findings are generic API detections (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) inside bundled content/assets/js/ files, with no suspicious destination host.
• Endpoint list is dominated by parser artifacts such as border.radius.circle and calls.function.arguments.delta, not real infrastructure.
• Both obfuscation findings (OBFUSCATION-LARGE_BASE64, OBFUSCATION-FUNCTION_INDIRECT) match normal minified bundle output.
• The only real services in the endpoint list are api.statsigcdn.com and app.wascript.com, the vendor's own automation backend.

False Positive Considerations

• XIOC extractor misreading CSS tokens and property-access chains as domains
• Generic code-quality YARA rules firing on bundled library code
• NET-* rules flagging ordinary fetch, socket.io and jQuery ajax usage required by the extension's stated function
• OBFUSCATION-FUNCTION_INDIRECT matching minified bundle output

Reviewed 2026-10-11; recommended action: monitor; model confidence 70%.