Simplia PRO - O seu WhatsApp no modo PRO.

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Simplia PRO is a WhatsApp Web CRM, published at version 7.4.3.87 by [email protected] with 4 users. Of the categories that decide a malicious verdict, every one is empty: no malware signature matched, no malware family rule matched, no secrets were found and nothing registered as tool poisoning. The remaining 1208 findings break down into 754 code-smell hits, 429 indicator-of-compromise hits, 22 network hits and 2 obfuscation hits. Those proportions describe a scan of bundled JavaScript, not unusually hostile code.

Every network finding is a library API call rather than a destination. NET-JQUERY_AJAX fires against content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js and its sibling versioned bundles, NET-SOCKET_IO fires against the ...28912.js, ...289149.js, ...289175.js and ...28966.js files, and NET-FETCH fires against background.js:137 plus the ...289137.js, ...289179.js, ...289235.js, ...289236.js, ...289261.js, ...289262.js and ...28927.js files. Socket.IO with fetch is the ordinary shape of a hosted CRM that keeps lead state in sync with a server. None of these findings identify where the traffic goes.

The endpoint list shows how much of the indicator volume to discount. Entries such as border.radius.circle, btn.glass, above.sm, below.sm, avatar.online and calls.function.arguments.delta are CSS values and JavaScript property chains that the extractor parsed as domains. The atlassian-us-gov-mod.com, api.dev.atlassian.com and atlassian-isolated.net strings are the vendor's own test and staging hostnames, the kind of text that ends up inside a bundled dependency. Two of the named endpoints are plausible service infrastructure: app.wascript.com, which fits the vendor's product line, and api.statsigcdn.com, a feature-flag CDN. Nothing in the list points at a login domain, a credential collector or a redirect chain.

The obfuscation hits deserve a direct answer because they are the strongest thing here. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, a file with a content hash in its name, and OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Hashed filenames plus inline base64 are what a production bundler emits when a build inlines fonts, sprites or a source map. Neither hit sits next to a malware signature, and a payload that arrived with an empty malware-signature bucket would be the first of its kind.

A skeptic would argue that a WhatsApp CRM reads every message in scope and pipes them through Socket.IO, which is a lot of trust for a publisher identified only by an email address on a generic store domain, and that the manifest data lists no permissions at all, so scope is unverified. That is fair, and it is why this is not a clean bill of health. But unverified scope is a gap in the scan, not evidence of harm. The findings themselves contain no target, no credential access pattern and no signature. Recovering the manifest's content_scripts matches and the Socket.IO server's hostname would settle it.

Key Reasons

• Zero findings in every decisive category: no malware signature, no malware family rule, no secret and no tool poisoning across 1208 results.
• All 22 network findings are library API detections (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX) inside versioned bundle files and background.js:137, none naming a destination.
• The endpoint list is dominated by IoC extractor noise such as border.radius.circle, btn.glass, above.sm and calls.function.arguments.delta, with only app.wascript.com and api.statsigcdn.com reading as real services.
• The two obfuscation hits (large base64 in a hash-named funnil asset, indirect function call in a versioned content bundle) match production bundler output and sit beside no malware signature.
• The remaining volume is 754 code-smell and 429 IoC findings, both documented noise categories that fire on any non-trivial bundled JavaScript.

False Positive Considerations

• IoC extractor parsed CSS values and JS property chains as domains (border.radius.circle, btn.glass, calls.function.arguments.delta, above.sm)
• 754 code-smell findings generated by bundled JavaScript in content/assets/js versioned bundles
• Network rules match library API usage rather than destinations (NET-FETCH, NET-SOCKET_IO, NET-JQUERY_AJAX in background.js and bundle files)
• Obfuscation rules fire on inlined base64 and indirect calls in hash-named build artifacts

Reviewed 2026-10-12; recommended action: monitor; model confidence 72%.