KASAPP

AI Security Review

Evidence context: threat category none; evidence quality moderate.

KASAPP describes itself as a CRM that connects to WhatsApp Web through a Chrome extension. The package we scanned holds 25 findings, all medium severity, and none of them are malware signatures, hardcoded indicators of compromise, exposed secrets or flagged dependencies. Two families account for everything: 22 network detections and 2 obfuscation detections.

The network detections are the three transports a chat-sync product needs. NET-SOCKET_IO fires at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15 and three sibling files. NET-FETCH fires across the same content/assets/js directory, including v_7_4_3_87_...261.js:1 and v_7_4_3_87_...262.js:1, and again at background.js:137. NET-JQUERY_AJAX fires at v_7_4_3_87_...923.js:1 and :13. Socket.IO, fetch and jQuery AJAX are the plumbing for a sidebar that stays in step with a server. The filenames themselves, with a version prefix and a long hex hash, come out of a build pipeline, so repeated detections of the same three patterns across 15 generated files are expected.

The two obfuscation detections are weaker still. OBFUSCATION-LARGE_BASE64 sits in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1, a hashed chunk inside a funnel folder. Large base64 blocks in bundled assets are inlined images, fonts and sprites. OBFUSCATION-FUNCTION_INDIRECT at content/assets/js/v_7_4_3_87_...260.js:1 is the indirect-call shape minifiers emit to save bytes. A build chunk is not obfuscation, and neither file carries a co-located malware signature.

One manifest-level finding appears in the scan summary, but its detail was not included in this data, so I cannot say what it flagged. That is the one gap in the evidence.

The strongest counterargument: a WhatsApp CRM is a high-privilege product. Its content script shares a page with a logged-in WhatsApp Web session, so it can read conversations, and the publisher is an email address at extensao.store attached to an extension with six users. That combination deserves scrutiny from anyone sending customer messages through it. What the code shows is a client talking to a back end with no unknown host recorded anywhere: zero IoC entries, zero malware matches, no credential-targeting logic, no cookie or token extraction, and no hardcoded suspicious domain. The risk sits with who receives the data. That is a question about the company; these files contain no hidden behavior.

If this extension were exfiltrating messages, the scan would show a hardcoded endpoint or an IoC entry pointing at a non-standard host. Neither exists here. What remains is the shape of a normal web app stored in a content/assets/js bundle. The endpoints background.js:137 calls, and runtime capture of the Socket.IO handshake, would settle where chat data goes.

Key Reasons

• No malware signatures, IoCs, secrets or suspicious domains anywhere in the scan; all 25 findings are medium-severity network and obfuscation detections.
• Network findings are Socket.IO, fetch and jQuery AJAX transports in content/assets/js build files and background.js:137, which is what a WhatsApp Web CRM requires.
• OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js:1 is inlined asset data inside a hashed build chunk.
• OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_...260.js:1 matches standard minifier output.
• One manifest-level finding is recorded but undetailed, and publisher identity ([email protected], 6 users) gives limited assurance.

False Positive Considerations

• Version-stamped and hashed build files under content/assets/js trigger generic network rules repeatedly
• Base64-inlined assets in the funnil/assets/js chunk read as obfuscation
• Minifier indirect-call pattern classified as obfuscation
• Socket.IO, fetch and AJAX calls are the extension's own sync mechanism, not exfiltration

Reviewed 2026-10-14; recommended action: monitor; model confidence 73%.