WaPower

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WaPower is a Chrome extension that adds CRM features to WhatsApp Web. It is published under the contact address [email protected], sits at version 7.4.3.86 with 37 users, and ships its logic as build-stamped bundles in content/assets/js/ alongside a service worker at background.js. The large finding count against it does not describe anything the code does. No malware signature matched: the malware-signature and malware counts are both zero, and there are no secret or tool-poisoning findings anywhere in the set.

The network findings are library fingerprints. NET-SOCKET_IO fires on content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js and content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2148.js because socket.io is bundled in. NET-JQUERY_AJAX fires on content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb223.js because jQuery's ajax helper is present. NET-FETCH fires on background.js:137 and on a dozen hashed chunks because any fetch call matches the same rule. None of those titles name a hardcoded host. Of the endpoints that were extracted, one belongs to the extension itself, app.wascript.com. The rest are noise: border.radius.circle, btn.glass and color.border.accent.orange are design-token property chains from a bundled design system, while api.atlassian.com, api.statsigcdn.com and avatar.online are strings that arrived inside dependencies. api.statsigcdn.com is Statsig's feature-flag service.

The two obfuscation hits are build artifacts. OBFUSCATION-LARGE_BASE64 flags funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js, a Vite-style hashed asset chunk where embedded fonts, icons and inline images normally live. OBFUSCATION-FUNCTION_INDIRECT fires once, on content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js, which is what a minifier leaves behind when it rewrites function references. Obfuscated malware usually pairs a packer with a matching family signature. There are zero family signatures here.

The strongest argument against this reading is that WaPower injects into WhatsApp Web. A content script running inside web.whatsapp.com can read every chat and contact list, and the extension's whole purpose is to move that data to app.wascript.com for CRM processing. The captured manifest also lists no permission strings and no host permissions, which is unexpected for an extension that has to run on WhatsApp, and the publisher is an email address with no company behind it. Those are real reasons to want more information from the developer, and they are reasons to publish a privacy note. None of it is evidence of misbehavior, and no finding describes a credential grab, a hijacked search provider, a proxy relay or a known malware family. If the manifest content_scripts matches are recovered and show access far beyond web.whatsapp.com, that would change this assessment. On the recorded findings, the scanner tripped on bundled code.

Key Reasons

• Zero malware-signature, malware, secret and tool-poisoning findings across 1,200 results.
• All network findings are framework pattern matches (NET-SOCKET_IO, NET-JQUERY_AJAX, NET-FETCH) in bundled content scripts and background.js:137, none naming a hardcoded host.
• Extracted endpoints are dominated by design-token property chains such as border.radius.circle and btn.glass, with app.wascript.com as the only first-party service.
• The two obfuscation hits are a Vite-style hashed asset chunk and a single minifier pattern, with no malware family co-located.

False Positive Considerations

• IoC extraction of design-token and property-chain strings misread as domains (border.radius.circle, btn.glass, color.border.accent.orange).
• Framework-level network rules firing on bundled socket.io, jQuery ajax and fetch calls in minified content scripts.
• 754 code-smell findings generated by bundled minified JavaScript rather than by malicious logic.
• Obfuscation rules triggering on asset-chunk base64 embedding and minifier function indirection.

Reviewed 2026-10-10; recommended action: monitor; model confidence 75%.