What Vision

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension "What Vision" describes itself as a CRM for Chrome, published by [email protected]. The scan identified 1,172 findings, but the nature of these findings reveals a pattern consistent with known false positive sources rather than malicious behavior.

The 418 IoC findings are the largest category, yet examination of the extracted network endpoints shows most are artifacts from CSS property names and JavaScript property access chains misread as domains. The endpoint list includes "border.radius.circle", "color.border.accent.orange", and "calls.function.arguments.delta" which are clearly not network destinations but rather frontend styling properties and code constructs. Legitimate domains like api.atlassian.com and api.statsigcdn.com appear alongside these artifacts, indicating the extension integrates with Atlassian services. The XIOC extractor's tendency to misread minified frontend code as IoCs explains the inflated count.

The 730 code-smell findings are all low severity and represent noise from the YARA rules that fire on any non-trivial JavaScript. These include postinstall patterns and credential references that match basic Node.js patterns in bundled dependencies. The content/assets/js/ directory contains versioned files like v_7_4_3_85_81c9fdf6-5aa3-4e05-88c1-f94c9eaf692012.js, which is typical of bundled frontend code that triggers multiplicative false positives across 50+ libraries.

The 21 network findings in background.js and content scripts show fetch, socket.io, and jQuery AJAX calls. These are standard web communication patterns. The background.js file makes three fetch calls at lines 52, 63, and 137, while the content scripts use socket.io for real-time communication and jQuery for AJAX requests. This is consistent with a CRM extension that needs to sync data with a backend service.

The 2 obfuscation findings are in bundled frontend code. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_85...253.js and OBFUSCATION-LARGE_BASE64 in funnil/assets/js/0c7a903c...9ZuTaqvp.js are common in minified/bundled JavaScript. The "funnil" directory likely contains a funnel library, and large base64 strings are typical in bundled assets.

Zero malware signatures matched. The extension declares no host_permissions or permissions, which is unusual for a CRM but also limits its potential impact. A CRM extension typically needs permissions to access web pages, but the absence of permissions means it cannot perform credential theft, browser hijacking, or data exfiltration even if it wanted to.

A skeptic might argue that the generic publisher email ([email protected]) and low user count (266) are red flags. However, the lack of malware signatures combined with the clear false positive patterns in the IoC and code-smell categories outweighs these concerns. The extension is a legitimate CRM integration with Atlassian products, bundled with frontend code that triggers known false positive detectors.

Key Reasons

• Zero malware signatures matched
• 418 IoC findings are mostly CSS properties and JS property chains misread as domains
• 730 code-smell findings are low-severity noise from bundled dependencies
• Legitimate Atlassian domains in endpoint list
• No permissions declared limits potential impact

False Positive Considerations

• IoC extractor misreading CSS properties as domains
• Code-smell YARA rules firing on bundled JavaScript
• Bundled dependencies creating multiplicative false positives
• Obfuscation findings in minified frontend code

Reviewed 2026-10-09; recommended action: suppress false positive; model confidence 75%.