SevenSales

AI Security Review

Evidence context: threat category none; evidence quality moderate.

SevenSales is a WhatsApp Web CRM extension published by [email protected] with 74 users. It declares no special permissions and no host permissions in its manifest. The extension communicates with app.wascript.com (a WhatsApp automation platform), api.atlassian-us-gov-mod.com, and api.statsigcdn.com. These endpoints are consistent with a CRM that integrates with third-party services.

The scan produced 1,173 total findings. Zero malware signatures matched any file. The 730 code-smell findings are all low severity and fire on standard patterns in bundled JavaScript, such as references to process.env, fetch, and crypto modules. These rules trigger on nearly any non-trivial codebase and carry no diagnostic value on their own.

The 419 indicators of compromise are dominated by strings the domain extractor misidentified as network destinations. The network_endpoints list includes border.radius.circle, color.border.accent.orange, btn.glass, calls.function.arguments.delta, and below.sm. These are CSS property names, design token identifiers, and JavaScript property access chains from minified code. They are not domains the extension contacts. The legitimate endpoints in that list (Atlassian APIs, Statsig CDN, wascript.com) match the extension's stated purpose.

The 21 network findings in background.js and the content/assets/js directory correspond to fetch calls, Socket.IO connections, and jQuery AJAX requests. A CRM that syncs conversation data with a backend server needs these communication patterns. The Socket.IO entries reference versioned asset files (v_7_4_3_85_81c9fdf6-...) that follow a standard build pipeline naming convention.

Two obfuscation findings warrant discussion. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_85_81c9fdf6-...253.js flags indirect function dispatch, a pattern common in transpiled or minified code. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js flags a base64-encoded block. The funnil directory name is unusual, and the UUID-named file with encoded content could deserve a closer look. Without malware signatures co-located in the same file, obfuscation alone does not establish malicious intent. Minified bundles routinely contain large encoded strings for fonts, images, or serialized configuration.

A skeptic would point to the generic publisher ([email protected]), the low user count (74), and the obfuscated base64 block in a strangely named directory as reasons for concern. Those signals are real but insufficient. The extension has no permissions to exfiltrate data beyond what WhatsApp Web itself exposes, no malware signatures matched, and the high finding count is explained by the scanner misreading CSS tokens and bundled library patterns as threats. The obfuscation findings need manual review of that specific file to rule out encoded payloads, but the rest of the evidence does not support a malicious classification.

Key Reasons

• 419 IoCs are CSS properties and JS property chains misread as domains (border.radius.circle, color.border.accent.orange)
• 730 code-smell findings are all low severity, triggered by bundled library patterns
• Zero malware signatures matched any file in the extension
• Network endpoints (wascript.com, Atlassian APIs) match the stated CRM purpose
• Two obfuscation findings lack co-located malware signatures

False Positive Considerations

• IoC extractor misreads CSS properties and JS property chains as domains
• Code-smell YARA rules fire on bundled npm libraries
• Minified and bundled JS triggers obfuscation heuristics

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 75%.