wazippy

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension 'wazippy' describes itself as a CRM for Google Chrome, published by a generic email address at extensao.store. It currently has only 10 users and declares no special permissions in its manifest. The scanner flagged 1,187 findings, but a close look at the evidence shows this volume is almost entirely driven by known false-positive patterns rather than actual malicious behavior.

The 408 IoC findings are the loudest signal in the bundle, yet they consist almost entirely of garbage. The network endpoints list includes strings like border.radius.circle, color.border.accent.orange, btn.glass, and calls.function.arguments.delta. These are CSS design tokens and JavaScript property access chains that the IoC extractor mistakenly parsed as domain names. The actual network endpoints are standard infrastructure like Atlassian APIs and app.wascript.com, which align with a CRM integrating with third-party services.

The 754 code-smell findings are all low severity and represent standard web development patterns. The 22 network findings simply flag the use of common web APIs like Fetch, Socket.IO, and jQuery AJAX across various content scripts in content/assets/js/. The two obfuscation findings point to a large Base64 string in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js and indirect function calls in a content script. While Base64 encoding can hide payloads, it is also routinely used to bundle fonts, images, or configuration data in modern web apps. Without any malware signatures to corroborate a hidden payload, this is just a code-smell signal.

A skeptic might point to the anonymous developer email and the Base64 obfuscation as reasons to distrust the extension. They would argue that a CRM with no permissions and a generic publisher is a prime candidate for a sleeper agent or data scraper. However, the extension literally cannot scrape data or hijack the browser without host permissions, which are completely absent from the manifest. The Base64 block sits in a file named with a funnel-related prefix, typical for marketing or onboarding scripts. The overwhelming majority of the scanner's alerts are mechanical misreads of frontend code, not indicators of compromise. The lack of permissions means the extension's actual capabilities are strictly limited to its own popup or options page, rendering the theoretical risks moot.

Key Reasons

• IoC extractor misidentifies CSS design tokens as network domains
• High volume of low-severity code-smell findings in bundled dependencies
• No malware signatures or malicious behavior detected
• Extension declares no special permissions in its manifest

False Positive Considerations

• IoC extractor misidentifying CSS design tokens as network domains
• High volume of low-severity code-smell findings in bundled dependencies
• Generic network findings for standard web APIs

Reviewed 2026-10-10; recommended action: monitor; model confidence 85%.