WhatsSelling

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Version 7.4.3.87 of WhatsSelling arrives with 1,193 scanner findings, and their shape matters more than their number. The malware scanner matched nothing: zero malware signatures, zero confirmed families, zero exposed secrets. Nearly all the volume sits in two high-noise categories, 754 code-smell hits and 414 indicator extractions. The 22 network findings and the 2 obfuscation findings carry the only real signal, and both hold up once you look at what they point to.

The network findings name frameworks rather than destinations. NET-JQUERY_AJAX fires inside content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js, NET-SOCKET_IO inside ...8912.js, ...89149.js, ...89175.js and ...8966.js, and NET-FETCH inside background.js:137 plus a dozen content assets. jQuery ajax, socket.io and fetch form the plumbing of any web app that talks to a server, and a CRM with a live inbox needs a persistent channel. The only named endpoints in the bundle, app.wascript.com and api.statsigcdn.com, fit that description: an application backend and a feature-flag service. api.atlassian.com and the atlassian-us-gov-mod.com hosts look like a bundled Atlassian SDK.

The endpoint list also carries extractor garbage. color.border.accent.orange, border.radius.circle, calls.function.arguments.delta, artboard.phone and btn.glass read as CSS custom properties and JavaScript property chains. They sit in the same list as above.sm and below.sm, which shows the indicator count measures token shape, not hosts contacted.

Two obfuscation flags appear. OBFUSCATION-LARGE_BASE64 lands on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and OBFUSCATION-FUNCTION_INDIRECT on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Long base64 strings appear in bundled front ends for inline images, fonts and source maps, and indirect calls appear in any transpiled output. A payload would show obfuscation alongside a malware signature, a credential-targeting domain or a cookie read. Obfuscation on its own tells us little.

A skeptic would point at the publisher. [email protected] reads as a mailbox rather than a company, the store listing misspells Chrome, the extension has 67 users, and the manifest shows no declared permissions or host permissions at all. An extension that opens a socket while declaring nothing could be siphoning page data. Three things undercut that reading. Nothing in the scans touches a login page, a session cookie or a password store. The socket destinations match the product's own backend. And the empty permission arrays come with a single manifest-analysis finding, so the manifest parse may simply be incomplete. A fresh scan of the manifest would settle it, and that gap is the only one worth closing.

Key Reasons

• Zero malware signatures, zero confirmed malware families and zero exposed secrets across 1,193 findings
• Network findings (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) match framework plumbing in bundled content assets, with named endpoints app.wascript.com and api.statsigcdn.com fitting a CRM backend
• 414 IoC entries include obvious non-hosts such as border.radius.circle and calls.function.arguments.delta
• Obfuscation flags (OBFUSCATION-LARGE_BASE64, OBFUSCATION-FUNCTION_INDIRECT) appear without adjacent malware signatures or credential-targeting domains
• Empty permissions and host_permissions arrays alongside a single manifest-analysis finding point to a parse gap rather than hidden capability

False Positive Considerations

• IoI extractor reading CSS custom properties and JS property chains (color.border.accent.orange, calls.function.arguments.delta) as domains
• 754 low-severity code-smell findings, a documented high-noise class
• Large base64 blob in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, normal for bundled front-end builds
• jQuery ajax, socket.io and fetch flags firing on standard web-app communication patterns in minified assets

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 70%.