Agência do Vale

AI Security Review

Evidence context: threat category none; evidence quality strong.

"Agência do Vale" describes itself as a CRM for WhatsApp Web, designed to organize chats and optimize business operations. The extension manifest declares no special permissions and no host permissions, meaning it lacks the broad access typically required to read or modify web page content across arbitrary domains. This inherently limits its capability to act as a traditional browser hijacker or credential stealer.

The scanner flagged 405 indicators of compromise, but examining the extracted network endpoints reveals they are almost entirely false positives. Strings like border.radius.circle, color.border.accent.orange, btn.glass, and calls.function.arguments.delta are clearly CSS design tokens, utility class names, or JavaScript property chains misidentified as domains by the IoC extractor. The legitimate endpoints found in the code belong to app.wascript.com, a known WhatsApp business API platform, and various atlassian.com subdomains. This perfectly aligns with the extension's purpose as a CRM tool that likely integrates with project management or ticketing software.

The remaining bulk of the 1184 total findings comes from 754 low-severity code-smell matches and two obfuscation flags. These low-severity matches are generated by generic rules that flag basic programming patterns like environment variable access or standard library imports, which are ubiquitous in any non-trivial application. The obfuscation findings, specifically OBFUSCATION-LARGE_BASE64 in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js, are standard characteristics of minified and bundled JavaScript frameworks. The funnil directory likely contains a bundled frontend library.

Similarly, the 22 network findings, such as NET-FETCH-background.js-137 and NET-SOCKET_IO-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js-15, simply detect the use of standard web APIs like fetch, socket.io, and jQuery.ajax in files like background.js and the various content scripts. None of these indicate data exfiltration or unauthorized tracking.

A skeptic might point out that the developer email, [email protected], is generic and the user count is only 24, which are common traits of throwaway malicious extensions. They might also argue that a WhatsApp CRM with zero host permissions is suspicious or broken. However, the complete absence of malware signatures, combined with the fact that every flagged domain is either a CSS token, a bundled library artifact, or a legitimate SaaS integration, leaves no evidence of malicious intent. The high finding volume is entirely an artifact of the scanner tripping on the noise inherent in modern bundled JavaScript and design system tokens.

Key Reasons

• IoC extractor misidentified CSS design tokens like border.radius.circle as network domains
• Zero malware signatures or malicious behavioral indicators found in the codebase
• Network endpoints resolve to legitimate SaaS integrations like app.wascript.com and atlassian.com
• Obfuscation findings are standard minified JavaScript artifacts in bundled library files
• Extension declares no host permissions, limiting its attack surface

False Positive Considerations

• IoC extractor misidentifying CSS class names and JS property chains as domains
• Code-smell rules triggering on standard bundled JavaScript and minified libraries
• Obfuscation rules flagging base64 and indirect functions in minified frontend bundles
• Network API usage rules flagging standard fetch and socket.io calls

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 92%.