WaSpeed: Superpoderes para o seu WhatsApp, CRM e muito mais.

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The scan of WaSpeed (v7.4.3.87) returned 1,212 findings, and none of them describe malware. Zero malware signatures matched, zero secrets were found, and no tool-poisoning rule fired. What the scan actually recorded is 754 code-smell hits and 433 IoC matches inside minified JavaScript, which is what any bundled webpack or esbuild output looks like when it is unpacked and read line by line. The files carrying most of that weight are hashed build artifacts under content/assets/js/, named v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289*.js.

The 22 network findings are pattern matches rather than destinations: NET-FETCH-content/assets/js/v_7_4_3_87_...289137.js-1, NET-SOCKET_IO-content/assets/js/v_7_4_3_87_...289149.js-64, and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_...28923.js-1. Fetch, jQuery ajax and Socket.IO are the three ordinary ways a chat-sync client talks to its server, and a CRM mirroring WhatsApp conversations has to hold a live connection open. The only endpoint in the list that belongs to this extension is app.wascript.com, the vendor's own backend. The Atlassian entries (api.dev.atlassian.com, api.stg.atlassian.com, atlassian-isolated.net) and api.statsigcdn.com come from bundled UI and feature-flag packages. The rest is extractor debris: border.radius.circle and btn.glass are CSS property values, above.sm and ae.jobs are fragments sliced out of minified strings, and a牰.vc contains a character no real domain can hold.

Two medium obfuscation findings deserve naming. OBFUSCATION-LARGE_BASE64-funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js-1 flags a large base64 blob in a static asset, which is usually a font or icon inlined at build time. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_87_...289260.js-1 flags indirect function calls, which is standard minifier dispatch. Neither one sits in the same file as a malware signature, and that pairing is what separates a disguised payload from normal build output. The recorded manifest also lists no host permissions and no API permissions; whatever reach this extension has comes from its content scripts rather than from a broad manifest grant.

A skeptic would push back hard here. A CRM that injects into WhatsApp Web can read every message, contact and group in the account, and forward a copy to app.wascript.com, and the developer identity is an email address, [email protected], not a company name. Thirty thousand users is a large blast radius for that capability. The reason the argument does not change the verdict is that the reach is the product, it is described in the store listing, and none of the things that turn reach into abuse appear anywhere in the scan: no malware signature, no credential rule against a login domain, no search-engine or new-tab replacement, no proxy, relay or exit-node code.

What would settle the remaining doubt is a runtime capture of the Socket.IO traffic to app.wascript.com. That would show exactly which fields leave the browser and whether anything is sent beyond the conversations the user has open.

Key Reasons

• Zero malware signatures, zero secrets and zero tool-poisoning findings across 1,212 matches
• 754 code-smell and 433 IoC hits concentrated in hashed minified bundles under content/assets/js/, a known false-positive pattern
• Network rules (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) match standard chat-client transports, with app.wascript.com as the extension's own backend and Atlassian/Statsig from bundled libraries
• Endpoint list contains clear extractor debris such as border.radius.circle, btn.glass and a牰.vc, which cannot be real domains
• The two medium obfuscation hits (LARGE_BASE64 in funnil/assets/js, FUNCTION_INDIRECT in ...289260.js) are not co-located with any malware signature

False Positive Considerations

• Bundled minified JavaScript producing hundreds of code-smell matches under content/assets/js/v_7_4_3_87_*
• IoC extractor reading CSS property values and minified string fragments as domains (border.radius.circle, btn.glass, above.sm, ae.jobs)
• Bundled Atlassian and Statsig library endpoints (api.dev.atlassian.com, api.statsigcdn.com) attributed to the extension
• LARGE_BASE64 and FUNCTION_INDIRECT obfuscation rules firing on standard build output and inlined assets

Reviewed 2026-10-14; recommended action: suppress false positive; model confidence 80%.