PERFORMANCE ZAP

AI Security Review

Evidence context: threat category none; evidence quality moderate.

PERFORMANCE ZAP describes itself as a CRM that adds features to WhatsApp Web, and the file layout matches that job. Everything of substance sits under content/assets/js/, where a script injected into a WhatsApp page would live, with background.js handling extension-level work. The network matches in that code are the ordinary vocabulary of a chat client. NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js-15 and three sibling socket.io files open a live channel, NET-FETCH entries such as NET-FETCH-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289137.js-1 and NET-FETCH-background.js-137 call fetch, and NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js-1 uses jQuery's ajax helper. A CRM panel that shows contact history beside a chat needs a live connection and a way to pull records. None of these rules says where the data goes.

The indicator list does say something, and it does not survive reading. Among the endpoints we can inspect are color.border.accent.orange, border.radius.circle, btn.glass, calls.function.arguments.delta, above.sm, below.sm and artboard.phone. Those are CSS design tokens and object property paths, the exact strings a parser lifts out of a bundle and mistakes for hostnames. The genuine hosts are api.statsigcdn.com, a feature-flagging service used across the web, a group of atlassian.com and atlassian-isolated.net API hosts that travel with a bundled UI library, and app.wascript.com, which belongs to this extension's own service. Nothing points at a bank, a login page or a token endpoint.

There are no malware signatures and no secrets in the bundle. The 754 code-smell findings are the low-severity rules that fire on any file calling fetch or touching crypto, and they carry no weight on their own. Two obfuscation findings deserve a mention. OBFUSCATION-LARGE_BASE64-funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js-1 flags an embedded base64 block, the normal way a bundle carries inlined images, fonts or source maps. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js-1 describes the indirection minifiers introduce when they rewrite direct calls to save bytes.

The strongest argument against this reading is the category itself. WhatsApp CRM extensions read a private messaging interface, so a hostile build could harvest contacts or chat history and ship them out. The publisher is only an email address and the extension has four users, so there is no reputation to lean on, and the base64 asset is the one item nobody has read end to end. Against that: no finding shows cookie, session or credential access, the manifest data we have lists no permissions or host permissions at all, and the only outside service named is the vendor's own backend. Nothing in the obfuscation findings sits next to a network call. What would settle it is decompiling funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and confirming the base64 decodes to an image or font. The inflated total comes from bundled library code and strings that were never addresses, which is an artifact of automated extraction rather than anything this extension does.

Key Reasons

• Zero malware signatures, zero secrets and zero tool-poisoning findings across 1193 total findings.
• The 414 indicators are dominated by CSS design tokens and property paths such as color.border.accent.orange, btn.glass and calls.function.arguments.delta, which are not hostnames.
• Network findings are generic fetch, socket.io and jQuery ajax matches inside bundled content scripts, which is expected for a live CRM panel on WhatsApp Web.
• The 754 code-smell findings belong to the known low-severity noise class that fires on any file calling fetch or crypto.
• Both obfuscation findings fit ordinary packaging: an inlined base64 asset in funnil/assets/js and a minifier indirection pattern in a content chunk.

False Positive Considerations

• IoC extractor reading CSS design tokens and JavaScript property chains as domains
• 754 low-severity code-smell matches generated by bundled library code
• Generic fetch, socket.io and jQuery ajax pattern rules firing on any client-side bundle
• Base64 blob and indirect-call patterns that appear in normal minified bundles

Reviewed 2026-10-13; recommended action: monitor; model confidence 72%.