CRM TURBINADO

AI Security Review

Evidence context: threat category none; evidence quality moderate.

CRM TURBINADO is a Brazilian customer-relationship tool packaged as a Chrome extension, scanned at version 7.4.3.87 with about 25 users. Its manifest declares no host permissions, and the working code sits in content/assets/js/ plus a parallel funnil/ (Portuguese for funnel) tree. Across 1,204 findings, the malware and malware-signature counters are both zero. Everything flagged is a library pattern, a code-quality match, or a string the extractor misread.

The 22 network findings are library fingerprints. NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js-1 fires on jQuery's AJAX helper, NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js-15 on the Socket.IO client, and NET-FETCH-background.js-137 on a fetch call in the service worker. A CRM that keeps a live chat feed and syncs records needs all three. None of these findings names a destination.

The endpoint list shows how much of the input is noise. Entries like border.radius.circle, btn.glass, color.border.accent.orange and calls.function.arguments.delta are CSS custom properties and object property chains, read as hostnames. The names that do resolve describe a business stack: api.statsigcdn.com for feature flags, api.atlassian.com and api.atlassian-us-gov-mod.com for Jira and Confluence, and app.wascript.com, a WhatsApp automation service. That set is what a Brazilian sales CRM would talk to.

Two obfuscation findings deserve naming. OBFUSCATION-LARGE_BASE64-funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js-1 flags a base64 block in a file whose name is a UUID plus a content hash. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js-1 flags function calls reached through property lookups. Both are standard bundler output; webpack and rollup generate hashed filenames and reference modules indirectly so they can be loaded on demand. The pattern that would worry us is a base64 block that decodes into executable code sitting in the same file as a malware signature, and that is absent here.

The remaining 754 findings are code-smell matches concentrated in those same bundled files. They flag generic patterns such as eval-shaped calls and weak randomness, which nearly any minified application triggers. A skeptic would point at the empty permission arrays and the publisher's only contact being an email address, [email protected], and argue that a WhatsApp-syncing tool declaring no host permissions is either misparsed or hiding what it can reach. The single manifest-analysis finding supports the misparse theory, so that question stays open. What the scan does establish is that the build contains no known-bad domain and no malware signature, and none of the code reads stored passwords or cookies. Following a WhatsApp conversation and writing the result into a CRM is the extension's stated job.

Key Reasons

• Zero malware or malware-signature matches across 1,204 findings
• All 22 network findings are library fingerprints (NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js-15, NET-JQUERY_AJAX-...d28923.js-1, NET-FETCH-background.js-137) with no named destination
• Resolvable endpoints form a normal business stack: app.wascript.com, api.statsigcdn.com, api.atlassian.com
• 425 IoC matches dominated by property-access and CSS tokens misread as domains (border.radius.circle, btn.glass, calls.function.arguments.delta)
• Obfuscation matches (LARGE_BASE64 in funnil/assets/js/9cf42769-...CgnacD38.js, FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_...289260.js) are webpack/rollup output patterns

False Positive Considerations

• IoC extractor read CSS custom properties and object property chains as hostnames
• 754 code-smell findings produced by bundled library code in content/assets/js/
• Network findings detect library APIs (jQuery AJAX, Socket.IO, fetch) rather than endpoints
• Base64 block and indirect call pattern are standard minified bundle output

Reviewed 2026-10-11; recommended action: monitor; model confidence 70%.