autozai – Otimize o tempo e multiplique as vendas no WhatsApp

AI Security Review

Evidence context: threat category none; evidence quality moderate.

autozai is a WhatsApp Web CRM: a shared inbox plus bulk sending through Meta's official API. Its purpose explains most of what the code does. background.js opens fetches at lines 52, 63 and 137, and the numbered bundles under content/assets/js/ carry socket.io and jQuery AJAX calls, which is what a live chat dashboard needs to stay connected.

The scan returned well over a thousand items. The tally itself tells you nothing. Seven hundred and thirty of them are code-smell rules of the kind that fire on any minified JavaScript, and 414 are indicator matches. Look at what those indicators actually are: above.sm, below.sm, ae.jobs, af.pf, artboard.phone, btn.glass, border.radius.circle, color.icon.accent.orange, calls.function.arguments.delta. CSS property names, file extensions and streaming-token strings lifted out of bundled libraries. None of them is an address this extension contacts. Exactly one host in the list reads like a real server, app.wascript.com, and that fits a vendor dashboard for this kind of tool.

The two obfuscation findings deserve a straight answer rather than a shrug. OBFUSCATION-LARGE_BASE64-funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js flags a large base64 blob. Bundlers embed images, fonts and small compiled modules that way, and that same file carries no malware signature. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920253.js is what indirection through a lookup table looks like in compiled output. Across the whole package, the malware-signature, malware, secret and tool-poisoning categories are empty.

A skeptic has a real case. Bulk messaging for WhatsApp sits close to spam, the publisher is a contact address rather than a company ([email protected]), the listing has 35 users, and the extracted manifest shows no permissions and no host permissions, which leaves the extension's actual reach unclear. A base64 blob inside a file named for a funnel feature is worth opening. If that blob decoded to executable code, or if traffic to app.wascript.com carried WhatsApp session cookies, the conclusion would flip. Two checks would settle it: decode the blob, and watch the first outbound request the extension makes after install.

What the evidence supports today is narrower. Every medium-severity finding traces back to library API names (NET-SOCKET_IO-content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920143.js-64, NET-JQUERY_AJAX-content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf692022.js-181) or to strings inside bundled files. That is a scanner describing compressed third-party code, not an extension doing something harmful.

Key Reasons

• Zero malware, malware-signature, secret and tool-poisoning findings across the whole package.
• 730 of the findings are low-severity code-smell rules that fire on any minified or bundled JavaScript.
• The endpoint list is dominated by extraction artifacts (border.radius.circle, btn.glass, above.sm, calls.function.arguments.delta), leaving app.wascript.com as the only plausible real host.
• Network findings are library API names inside hashed vendor bundles (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH in background.js), consistent with a chat dashboard.
• The two obfuscation flags sit on a bundled asset (funnil/assets/js/0c7a903c-...9ZuTaqvp.js) and a compiled vendor chunk with no malware signature alongside them.

False Positive Considerations

• IoCI extractor emitted CSS property names, file extensions and streaming-token fragments as domain names
• Code-smell rules inflating the count on bundled and minified vendor JavaScript
• Generic fetch/socket.io/jQuery AJAX calls in hashed vendor chunks scored as medium network findings
• Large base64 blob in a bundled funnel asset read as obfuscation rather than an embedded asset

Reviewed 2026-10-02; recommended action: monitor; model confidence 72%.