AmizApp

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The AmizApp extension describes itself as a CRM for WhatsApp Web, but the evidence tells a different story about what the scanner actually found. Of the 1,188 total findings, 754 are classified as code-smell at low severity. These match patterns like postinstall_* and credential_* rules that fire on any non-trivial JavaScript. They detect that the code uses standard web APIs. They do not detect harmful behavior. The remaining 409 IoC findings follow the same pattern. The network endpoints extracted include strings like border.radius.circle, color.border.accent.orange, and btn.glass, which are CSS design tokens from a UI framework. These are not domains the extension contacts. The IoC extractor pulled property access chains and style values and counted them as indicators of compromise.

The 22 network findings all detect standard web API usage. Files like content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js trigger NET-JQUERY_AJAX and NET-SOCKET_IO detections. The background.js file triggers a NET-FETCH detection at line 137. A CRM that syncs chat data with a backend server needs these APIs. None of the network findings point to suspicious external domains.

Two obfuscation findings exist. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1, which contains a large base64 string. This is consistent with an embedded font, image, or configuration payload. OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1, a pattern common in minified bundles where function references are assigned through intermediate variables. Neither finding co-occurs with malware signatures. Zero malware signatures matched across the entire extension.

The network endpoints list includes api.dev.atlassian.com and api.stg.atlassian.com, which are Atlassian development and staging APIs. A WhatsApp CRM has no obvious reason to contact Atlassian servers. These likely originate from a bundled dependency that includes Atlassian SDK code, or from the IoC extractor matching substrings in unrelated code. The extension also declares zero permissions and zero host permissions. It cannot interact with WhatsApp Web's DOM or read messages. A CRM that cannot access the page it claims to manage is either broken or its manifest is incomplete.

A skeptic would point to the Atlassian endpoints and the obfuscation findings as evidence of hidden behavior. The counterargument is straightforward. Zero malware signatures matched. The obfuscation findings are isolated and lack co-located malicious indicators. The Atlassian domains sit alongside obvious false positives like CSS design tokens. The extension's low user count of 36 and generic developer email ([email protected]) raise legitimacy questions. Legitimacy is separate from malice. The scanner tripped on bundled code patterns and design system strings. No finding demonstrates malicious behavior.

Key Reasons

• 754 code-smell findings at low severity fire on standard JavaScript patterns
• 409 IoC findings include CSS design tokens like border.radius.circle and color.border.accent.orange
• Zero malware signatures matched across the entire extension
• 22 network findings detect standard web API usage (fetch, jQuery AJAX, Socket.IO)
• Two obfuscation findings are isolated and lack co-located malicious indicators

False Positive Considerations

• IoC extractor matching CSS design tokens and property access chains
• Code-smell rules firing on standard web API usage
• Bundled dependencies creating multiplicative false positives
• Obfuscation rules matching minified bundle patterns

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 72%.