Gestor B2B - WhatsApp que vende

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Gestor B2B is a WhatsApp sales CRM, and the question its scan raises is whether a chat organizer needs this much network reach. The evidence says it does.

Start with what did not match. The scan produced 1,210 findings and not one malware signature or confirmed malware detection. Of the total, 754 are code-quality notes and 431 are indicator-of-compromise matches, the two buckets that grow with any bundled JavaScript build. What is left is worth reading one entry at a time: 22 network findings and two obfuscation findings.

The network entries are library calls. NET-SOCKET_IO fires in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and ...149.js, NET-JQUERY_AJAX in ...23.js and ...24.js, and NET-FETCH in background.js:137 along with a dozen files under content/assets/js/. Socket.IO, jQuery's ajax wrapper and fetch are the plumbing of a live chat panel that stays in sync with a backend, which is the job this extension advertises. None of those findings name a destination host. They record that a request was made, and the destination is absent from the finding.

The obfuscation entries carry the most weight and hold up the least. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js both fire on compiled output. A large base64 blob inside a UI bundle is usually an embedded font, an icon sprite or a source-map fragment, and indirect function references are what every minifier leaves behind after renaming exports. Neither file carries a malware signature, and the pairing of obfuscation with a real signature inside one file is the pattern that would change this assessment.

The endpoint list is where the extractor shows its seams. Beside app.wascript.com and api.statsigcdn.com sit entries like border.radius.circle, color.border.accent.orange and calls.function.arguments.delta. Those are CSS design tokens and property-access chains lifted out of minified strings. When a domain list contains Tailwind class names, the list is measuring the extractor's string matching rather than the extension's traffic.

The counterargument is that a tool built to automate WhatsApp conversations sits one step from a bulk-messaging script, and the publisher identity, [email protected], is an email address rather than a company name. That is fair as a description of the product category, and it would be the reason to look closer if the capability were present. The evidence shows permissions declared as empty and host_permissions as empty, so the manifest in this build does not ask for access to WhatsApp pages or anything else. Should a later version request host access to web.whatsapp.com, the same fetch and socket code would deserve a second look. In this build nothing connects the network calls to a destination, and no signature matched anywhere.

Key Reasons

• Zero malware signatures and zero confirmed malware detections across 1,210 findings
• Network findings are unnamed Socket.IO, jQuery AJAX and fetch calls in bundled content scripts and background.js:137
• The two obfuscation findings fire on compiled bundle output with no malware signature in the same file
• IoCs include CSS design tokens such as border.radius.circle and color.border.accent.orange mistaken for hostnames
• Manifest declares empty permissions and host_permissions

False Positive Considerations

• IoC extraction from minified CSS and property-access strings
• Code-smell rules firing on 754 bundled library files
• Minifier output flagged as OBFUSCATION-LARGE_BASE64 and OBFUSCATION-FUNCTION_INDIRECT
• Standard library calls (socket.io, jQuery ajax, fetch) counted as network threats

Reviewed 2026-10-12; recommended action: suppress false positive; model confidence 80%.