WaBest

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WaBest is a WhatsApp Web CRM extension with 825 users. The evidence shows 21 network findings in background.js and bundled content scripts (fetch, Socket.IO, jQuery AJAX calls), which aligns with a CRM that syncs chat data to a backend. Two obfuscation findings appear in minified asset files (content/assets/js/v_7_4_3_84_... and funnil/assets/js/...) — these are typical of bundled JavaScript, not intentional hiding. The remaining 727 findings are code-smell rules (postinstall_*, credential_*, NoUseEval, etc.) that fire on almost any non-trivial JavaScript and are classified as low-severity noise. No malware signatures, no suspicious IOCs, no credential-theft indicators, and no browser-hijacking behavior were detected. The developer is listed only as an email ([email protected]), but the extension's purpose, permissions (none declared), and findings match a legitimate WhatsApp productivity tool. The strongest counterargument would point to the obfuscation findings and anonymous publisher as risk signals. However, the obfuscation occurs in hashed asset filenames consistent with webpack/rollup output, and the network endpoints are not hidden — they appear in plain fetch/Socket.IO calls. No evidence suggests data exfiltration, proxyware, or deceptive behavior.

Key Reasons

• No malware signatures or suspicious IOCs
• Network activity consistent with CRM backend sync
• Obfuscation findings in hashed bundle files (webpack/rollup output)
• 727 code-smell findings are known false-positive YARA rules
• No deceptive naming, hijacking, or credential-theft indicators

False Positive Considerations

• code-smell YARA rules (727 findings)
• bundled dependency artifacts in dist/assets
• minified JavaScript flagged as obfuscation

Reviewed 2026-09-30; recommended action: no action; model confidence 82%.