UATZAP CRM

AI Security Review

Evidence context: threat category none; evidence quality moderate.

UATZAP CRM arrives as a bundled web application. Most of its JavaScript sits under content/assets/js/ in hashed files such as v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb224.js, with a second tree under funnil/assets/js/ and a top-level background.js. The manifest declares no permissions and no host permissions, so nothing in this package asks for history, cookies, tabs or downloads.

The network findings are library-level. NET-FETCH, NET-JQUERY_AJAX and NET-SOCKET_IO mark the points where the bundle calls the native fetch API, jQuery's ajax helper, or a socket.io client. A CRM that syncs records and pushes live updates needs all three. The endpoints that survive scrutiny are app.wascript.com, which reads as the product's own backend, api.statsigcdn.com for feature-flag delivery, and api.dev.atlassian.com, api.stg.atlassian.com and atlassian-isolated.net from Atlassian frontend libraries. None of them are login, banking or credential-harvesting domains.

Two obfuscation findings land on minified chunks. OBFUSCATION-FUNCTION_INDIRECT on content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js and OBFUSCATION-LARGE_BASE64 on funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js describe indirect function references and an inlined base64 asset, both standard bundler output. No malware signature and no malware family rule matched anywhere in the package.

What is missing carries the weight here. A credential stealer leaves IoCs pointing at login pages and code that reads document.cookie; a hijacker rewrites the search provider or the new tab page; a proxyware extension ships relay code. None of those appear. The code-smell entries all sit at low severity and flag generic JavaScript constructs, which is what that rule set does to any non-trivial bundle.

The honest counterargument: the publisher is identified only as [email protected], the extension has few users, and a socket.io client does hold a persistent connection to a server this scan does not name. A CRM also holds customer records, so where those records go is a fair question. What would settle it is the content_scripts match patterns from the manifest and the socket.io connection URL, neither of which is present in the analyzed files. Those are coverage gaps rather than signs of harm, and they do not outweigh the absence of any malicious category.

Key Reasons

• No malware signatures and no malware family matches in the scan; every finding is code-smell, IoC, library-level network or minification related.
• All network findings are ordinary patterns (NET-FETCH, NET-JQUERY_AJAX, NET-SOCKET_IO) inside hashed bundle files under content/assets/js/ and background.js.
• Remaining endpoints are app.wascript.com, api.statsigcdn.com and Atlassian API/CDN hosts, with no login, banking or credential domains.
• No permissions or host_permissions requested, and no cookie, credential, search-hijack or new-tab findings.
• IoC volume is invalidated by non-domain tokens such as 'btn.glass' and 'border.radius.circle' in the endpoint list.

False Positive Considerations

• IoC extractor read CSS class names and property chains as domains (btn.glass, border.radius.circle, calls.function.arguments.delta).
• Code-smell rules firing on minified bundle output across content/assets/js/ and funnil/assets/js/.
• NET-FETCH, NET-JQUERY_AJAX and NET-SOCKET_IO matching standard library calls in a bundled web app.
• OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT matching normal bundler artifacts.

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 76%.