Econectada - CRM WhatsApp Web

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Econectada - CRM WhatsApp Web (version 7.4.3.87, Chrome Web Store, 69 users) describes itself as a CRM running inside WhatsApp Web. The manifest declares no permissions and no host permissions, so every capability the code exercises comes from content scripts injected into pages the user already visits. The publisher identifies itself only as [email protected].

The 22 network findings name library APIs rather than remote infrastructure. NET-JQUERY_AJAX appears in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, NET-SOCKET_IO in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and ...289149.js, and NET-FETCH in background.js:137 plus a dozen version-stamped bundle files. Those titles mark jQuery's $.ajax, the socket.io client and the fetch API sitting inside a bundled front end. The endpoint list shows how loosely extraction runs: above.sm, be.audio, border.radius.circle and calls.function.arguments.delta all look like minified property chains read as hostnames. Two entries do stand apart, app.wascript.com and api.statsigcdn.com. The atlassian entries (api.dev.atlassian.com, api.atlassian-us-gov-mod.com) belong to packaged library code.

The two obfuscation hits follow the same pattern. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js flags an embedded base64 block, and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js:1 flags indirection on line one of a minified file. Neither matches a packer signature, and base64 chunks of that shape show up in font, image and inline-data assets.

Of the 1189 findings, 754 carry code-smell severity and 410 land in the IoC bucket. Malware signatures, malware, secrets, dependency and tool-poisoning all read zero. Code-smell rules fire on routine browser and Node patterns, and this volume matches what a bundled front end produces.

A skeptic would push back on two points. A publisher named only by an email address, an unrecognised domain (app.wascript.com) and a websocket client inside an extension that reads WhatsApp Web content together describe a plausible message-exfiltration channel. The bundle gives no support for that reading: no malware signature matched, no credential or cookie access appears, the manifest requests no host permissions, and the websocket code sits in files carrying the extension's own version string. A runtime capture of WhatsApp message bodies leaving for app.wascript.com would settle it. Without that, the case rests on library code.

Key Reasons

• All 22 network findings map to bundled library APIs (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) in version-stamped files under content/assets/js/, matching an application front end
• Zero findings in malware-signature, malware, secret, dependency and tool-poisoning categories across 1189 total findings
• The 410 IoC entries include obvious extractor artefacts such as above.sm, be.audio, border.radius.circle and calls.function.arguments.delta, which are minified property chains
• Both obfuscation hits (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/...289260.js:1) describe bundled or minified code, not a packer
• The manifest declares no permissions and no host permissions, so the extension cannot read cookies, credentials or tabs beyond its content-script scope

False Positive Considerations

• 754 code-smell findings generated by normal JavaScript and Node patterns in a bundled front end
• 410 IoC strings from minified code, including property chains misread as domains
• Minified bundle flagged as FUNCTION_INDIRECT obfuscation and an asset base64 block flagged as LARGE_BASE64
• Finding volume inflated by bundled dependencies under content/assets/js/ and funnil/assets/js/

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 72%.