UpSell

AI Security Review

Evidence context: threat category none; evidence quality moderate.

UpSell is a CRM layer for WhatsApp Web, and the code in the package lines up with that description. Content scripts sit under content/assets/js/, a service worker runs in background.js, and the network findings are the plumbing a live chat client needs: NET-SOCKET_IO-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js-15, NET-JQUERY_AJAX-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js-1, and NET-FETCH hits spread across the numbered chunks plus background.js:137.

No malware signature matched anywhere. The categories that would carry real weight, malware, malware-signature, secret, tool-poisoning and dependency, are all empty, and there are no critical or high severity findings. The 754 low severity entries are code-quality rules that fire on ordinary JavaScript constructs, so they tell us the codebase is large, not that it is hostile.

The 404 IoCs are the loudest thing here and the least useful. Look at what they actually are: border.radius.circle, btn.glass, color.border.accent.orange, artboard.phone, avatar.online, calls.function.arguments.delta. Those are CSS class names and a field in a streaming API response that the extractor turned into hostnames. The real domains in the list are unremarkable. app.wascript.com is the developer's own service, api.statsigcdn.com is a feature-flag provider, and the Atlassian hosts come from bundled tooling.

Two obfuscation matches deserve scrutiny and both have a mundane explanation. OBFUSCATION-FUNCTION_INDIRECT-content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js-1 matches function indirection typical of minified bundles. OBFUSCATION-LARGE_BASE64-funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js-1 is a large base64 blob inside a hashed chunk. A base64 payload with no malware signature in the same file usually decodes to an inlined font, image or worker. Nothing in this package shows chat content leaving for an unexpected host.

The strongest case against this reading: a WhatsApp CRM reads every message in a user's chats, the publisher is a bare contact address, and funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js is still unexplained. That is a fair worry, and it would take two things to settle it: the decoded contents of that file, and the manifest, which came back empty in this scan. Neither the endpoints nor the finding set shows exfiltration though. Reading chats is inherent to what the extension is advertised to do.

What we would still like on the record is the decoded base64 blob and the missing manifest permissions, because the one genuine gap in this evidence is what the extension actually asks the browser for.

Key Reasons

• No malware, malware-signature, secret, dependency or tool-poisoning findings anywhere; 754 of the 1,183 entries are low-severity code-quality rules that fire on ordinary JavaScript.
• The endpoint list is dominated by extractor artifacts such as btn.glass, border.radius.circle and calls.function.arguments.delta, none of which are real hosts.
• Network matches (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) match the real-time plumbing a WhatsApp CRM requires, with no unexpected destination.
• Both obfuscation matches are minification artifacts: FUNCTION_INDIRECT in a hashed content bundle and LARGE_BASE64 in a webpack chunk under funnil/assets/js/.
• The only real external domains are app.wascript.com (developer's own service) and api.statsigcdn.com (feature flags).

False Positive Considerations

• XIOC extractor misread CSS class names and JavaScript property paths as domains (btn.glass, color.border.accent.orange, calls.function.arguments.delta)
• 754 low-severity code-smell matches generated by bundled and minified JavaScript
• NET-JQUERY_AJAX, NET-SOCKET_IO and NET-FETCH rules fire on any content script using standard HTTP and websocket libraries
• OBFUSCATION-FUNCTION_INDIRECT and OBFUSCATION-LARGE_BASE64 match normal webpack output and inlined assets

Reviewed 2026-10-16; recommended action: monitor; model confidence 72%.