Dental Chat - Gestão de leads e pacientes no Whatsapp para Clínicas

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension, "Dental Chat - Gestão de leads e pacientes no Whatsapp para Clínicas," is a Portuguese-language tool for Brazilian dental clinics to manage WhatsApp patient communications. It has 67 users and is published by [email protected].

The scanner flagged 1,154 findings, but the nature of those findings tells a different story than the raw count. Zero malware signatures matched the code. The 403 IoC findings are almost entirely false positives generated by the extractor misreading CSS design tokens and JavaScript property chains as domain names. The network endpoints list includes entries like color.border.accent.orange, border.radius.circle, btn.glass, and calls.function.arguments.delta. These are design system variable names and property access patterns from bundled frontend code, misidentified by the scanner as domain names. Real infrastructure domains in the list, such as api.dev.atlassian.com and api.statsigcdn.com, belong to Atlassian and Statsig, both legitimate third-party services commonly embedded in web applications.

The 21 network findings in background.js and the content/assets/js/v_7_4_3_84_*.js files flag standard web communication patterns: NET-FETCH, NET-SOCKET_IO, and NET-JQUERY_AJAX. The file naming convention, with version-prefixed UUIDs like v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a112.js, is characteristic of build tool output from webpack or similar bundlers. These files contain hundreds of bundled npm dependencies, each contributing its own IoC and code-smell matches. The 727 code-smell findings are all low severity and fire on basic JavaScript patterns present in any non-trivial application.

Two obfuscation findings were recorded. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_84_5d4486fa-7201-47e2-ab22-dda3ca1a73a1254.js and OBFUSCATION-LARGE_BASE64 in funnil/assets/js/fa595624-57e9-42a8-be2b-801bd6c35351.CdHxSFqr.js both reside in files with hash-based names typical of compiled build artifacts. Indirect function calls and base64-encoded assets are standard output from modern JavaScript bundlers.

A skeptic might point to the anonymous developer identity, the obfuscation findings, and the fact that this extension handles WhatsApp communications for medical clinics as reasons for concern. Those are valid things to notice. The obfuscation findings live in bundled build output, the developer identity is common for small Brazilian software shops publishing niche tools, and there is not a single malware signature in the entire codebase. The extension declares no host permissions, which means it cannot silently read data from other websites or inject content into arbitrary pages. A tool that actually stole WhatsApp session tokens or exfiltrated patient data would need permissions to access WhatsApp Web and would show malware signatures targeting authentication cookies or WebSocket frames. None of that is present here.

The finding volume is a product of bundled dependencies multiplying false positives across hundreds of npm packages, combined with an IoC extractor that cannot distinguish CSS property names from domain names. The extension does what its name and description say it does, and the code contains no evidence of malicious behavior.

Key Reasons

• Zero malware signatures in the entire codebase
• 403 IoC findings are CSS design tokens and property chains misidentified as domains (e.g., color.border.accent.orange, btn.glass)
• 727 code-smell findings are all low severity and fire on standard JavaScript patterns in bundled code
• 21 network findings are standard fetch/socket.io/jQuery AJAX patterns in build-tool output files
• 2 obfuscation findings reside in hash-named build artifacts consistent with webpack or rollup output

False Positive Considerations

• IoC extractor misreads CSS design tokens (color.border.accent.orange, border.radius.circle) as network domains
• Bundled npm dependencies multiply IoC and code-smell matches across hundreds of libraries
• Code-smell rules fire on standard JavaScript patterns in non-trivial applications
• Obfuscation findings triggered by minified build-tool output with hash-based filenames

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 82%.