WAction

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WAction is a Chrome build of a WhatsApp Web CRM: a panel that adds tagging, contact sorting and notes to web.whatsapp.com. The scan returned over a thousand findings and almost none of them describe behavior a user would object to. There are zero malware signatures, zero malware family matches, zero secrets and zero critical or high severity results. What remains is low-severity code-smell output, extractor noise, library-level network hits and two obfuscation flags.

The network detections are library imports inside build-hashed bundles. NET-JQUERY_AJAX fires at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28924.js:181, NET-SOCKET_IO at the matching v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15, and NET-FETCH at background.js:137. They match because the extension ships jQuery, a socket.io client and plain fetch calls. A chat tool that holds a live connection to a backend does all three by design, so those alerts mark the plumbing the product needs.

The domain list explains most of the volume. Entries such as border.radius.circle, btn.glass and color.border.accent.orange are Atlassian Design System token names, and calls.function.arguments.delta is a field name from a streaming API response. None of these is a hostname. The endpoints that are real, api.statsigcdn.com, app.wascript.com and api.dev.atlassian.com, fit feature-flag delivery, the vendor's own backend and the bundled design-token package. No login domain, bank or mail provider shows up anywhere in the set.

The two obfuscation flags deserve a direct look. OBFUSCATION-LARGE_BASE64 sits in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Large base64 blocks in bundled interface code are usually embedded icons, fonts or templates, and indirect function calls are what minifiers produce. Neither file carries a malware signature beside it, which is the combination that would change this reading.

A skeptic would point at the publisher. [email protected] is an email address with no company behind it, the extension has eleven installs, and the manifest extraction returned empty permission and host permission lists. An extension that draws inside WhatsApp Web has to hold host access to that origin, so an empty list points to an incomplete manifest read. A re-read of the manifest would close that gap, and it would not change the finding-level picture: no credential access, no cookie reads, no exfiltration path.

Another counterargument is the base64 block itself. Encoded payloads are a real technique. What argues against it here is placement: the file sits in a UI asset directory next to sibling bundles, and a payload would normally arrive with a signature match or a destination that has nothing to do with the product. Runtime analysis that decodes the funnil check and logs the origins the socket actually opens would settle it.

Key Reasons

• Zero malware, malware-signature, secret or credential-theft findings across the entire scan
• All network findings are library-level detections (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) inside build-hashed bundle files and background.js
• The IoC set is dominated by design-token strings and JS property chains misread as hostnames, with the real domains belonging to the vendor backend, feature flags and a bundled design package
• The two obfuscation flags describe minified bundle output and a base64 asset in funnil/assets/js, with no malware signature co-located
• No behavior-level evidence of harm: no cookie reads, no login-domain targets, no external exfiltration endpoints

False Positive Considerations

• Bundled dependencies and minified output: jQuery, socket.io and fetch detections across content/assets/js and background.js
• XIOC parser garbage: Atlassian design tokens such as border.radius.circle and property chains such as calls.function.arguments.delta read as domains
• Low-severity code-smell volume that fires on ordinary JavaScript
• OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT matching normal bundle and minifier output

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 73%.