App Vendas CRM

AI Security Review

Evidence context: threat category none; evidence quality strong.

The "App Vendas CRM" extension presents a classic case of scanner noise overwhelming a benign application. The extension's stated purpose is to automate customer service interactions within Google Chrome. It achieves this by connecting to legitimate third-party services, which explains the network findings scattered throughout the codebase.

The network findings in background.js (lines 52, 63, 137) and various content scripts under content/assets/js/ trigger NET-FETCH, NET-SOCKET_IO, and NET-JQUERY_AJAX alerts. These alerts indicate that the extension is making standard HTTP requests and using Socket.IO for real-time communication. This is entirely expected for a CRM tool that needs to sync data and handle live chat integrations. The presence of app.wascript.com in the network endpoints confirms a connection to a known WhatsApp API service, aligning perfectly with the extension's customer service automation goal.

The massive volume of 1,161 total findings is driven almost entirely by false positives. The 407 IoC alerts are largely garbage extracted from CSS and JavaScript files. Endpoints like color.border.accent.orange, border.radius.circle, and calls.function.arguments.delta are clearly CSS properties and JS object paths misinterpreted as domain names. The 730 code-smell findings are low-severity alerts that fire on basic JavaScript patterns, such as standard Node.js or frontend framework structures, which are ubiquitous in modern web development.

Two obfuscation findings were flagged: OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf6920253.js and OBFUSCATION-LARGE_BASE64 in funnil/assets/js/0c7a903c-6665-4db4-bec2-13ad7e8d3381.9ZuTaqvp.js. Indirect function calls are a common feature of minified or transpiled JavaScript, not necessarily malicious obfuscation. Large base64 strings in bundled asset directories typically represent embedded fonts, images, or compiled library payloads, which is standard practice for reducing HTTP requests in web applications.

Zero malware signatures matched the extension's files. There is no evidence of credential theft, browser hijacking, or malicious data exfiltration. The extension declares no special permissions and requests no host permissions, severely limiting its ability to perform malicious actions even if it wanted to.

A skeptic might point to the generic developer email ([email protected]) and the high finding count as reasons for suspicion. They could argue that an anonymous developer with a heavily flagged extension warrants a cautious approach. However, the nature of the findings completely undermines this concern. The alerts are generated by the scanner misreading CSS variables and standard bundled dependencies, not by detecting actual malicious behavior. Without a single malware signature and with no host permissions to exploit, the extension lacks both the intent and the capability to cause harm. The 1,161 findings are simply the scanner doing its job poorly on a standard web application.

Key Reasons

• Zero malware signatures detected across all scanned files
• 407 IoC findings are largely CSS properties and JS object paths misread as domains
• 730 code-smell findings are low-severity alerts firing on standard JavaScript patterns
• Extension declares no host permissions, limiting its ability to perform malicious actions
• Network endpoints like app.wascript.com align with the stated CRM and WhatsApp integration purpose

False Positive Considerations

• IoC extractor misreading CSS properties like color.border.accent.orange as domains
• Code-smell rules triggering on standard bundled JavaScript dependencies
• Obfuscation rules flagging minified JS and base64-encoded bundled assets
• Network findings flagging standard HTTP and Socket.IO requests to legitimate APIs

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 85%.