WaMed

AI Security Review

Evidence context: threat category none; evidence quality moderate.

WaMed (version 7.4.3.87) describes itself as a CRM for WhatsApp Web, and the code matches that description. The manifest declares no permissions and no host permissions, so the extension does not request broad access to tabs, cookies or the clipboard. Its real capability sits in content/assets/js/. Those bundled scripts open WebSocket sessions (the NET-SOCKET_IO hits in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js and v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js), issue HTTP requests (NET-FETCH in background.js and roughly a dozen content/assets/js files), and use jQuery's ajax wrapper (NET-JQUERY_AJAX in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28923.js). A live chat dashboard needs all three to stay in sync with a server, and the named endpoint app.wascript.com is the vendor's own service. None of the network findings point at a domain unrelated to that service.

Most of the report is noise. Of the 1185 findings, 754 are code-smell hits and 406 are IoCs. The code-smell rules fire on ordinary JavaScript constructs and are classified low severity by design. The IoC list shows what the extractor is doing: entries such as above.sm, ae.jobs, af.pf, below.sm, avatar.online, artboard.phone and color.border.accent.orange are string fragments and CSS token values, not hostnames the extension contacts. Anyone reading that list should discount it wholesale.

Two obfuscation findings deserve a direct answer. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js, and a large base64 payload is a genuine hiding place for code. OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js. Both files carry hashed build-output names, and packed npm libraries produce these two signatures through minification and helper indirection alone. The malware signature count is zero across the whole extension. A payload concealed behind base64 would normally sit beside a detection from a family rule, and none matched.

A skeptic would say the deployment pattern is the problem whatever the scanner found: a developer name that is an email address, a Brazilian language marketplace listing, and a vendor endpoint that receives chat metadata. That is a fair privacy question about app.wascript.com. It is not evidence of malicious code. The extension asks Chrome for no permissions, its traffic goes to one identifiable service, and no malware family matched anywhere in the bundle.

My read is that the finding volume comes from bundled libraries plus a domain extractor that misreads fragments, which is the well-documented false-positive profile for this scanner. The two obfuscation matches sit in bundle files with no malware family behind them, and the medium-severity network hits are the socket and fetch calls any syncing dashboard needs.

Key Reasons

• Zero malware signatures across 1185 findings, with the volume driven by 754 low-severity code-smell hits and 406 IoC fragments such as above.sm and color.border.accent.orange
• Network findings are all standard sync patterns (NET-SOCKET_IO, NET-FETCH, NET-JQUERY_AJAX) in content/assets/js/ and background.js, pointing at the vendor's own app.wascript.com
• Manifest declares no permissions and no host permissions, so no access to tabs, cookies or clipboard is requested
• Two obfuscation matches (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769.js, OBFUSCATION-FUNCTION_INDIRECT in v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js) sit in hashed build-output files consistent with bundled npm code

False Positive Considerations

• Bundled dependency code producing hundreds of low-severity code-smell matches
• IoC extractor misreading minified JS fragments and CSS values as domains
• Minified build output triggering base64 and indirect-call obfuscation heuristics
• WebSocket and fetch calls inherent to a live WhatsApp Web dashboard

Reviewed 2026-10-11; recommended action: no action; model confidence 82%.