Primeira Classe

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Primeira Classe is a WhatsApp Web CRM that adds chat organisation and message automation to web.whatsapp.com. The scan returned 1,184 findings and none of them are malware: malware-signature 0, malware 0, secret 0, dependency 0, tool-poisoning 0. What is left is 754 code-smell entries, 405 IoCs, 22 network matches, 2 obfuscation matches and a single manifest-analysis item.

The network findings describe bundled libraries, not custom data channels. Titles such as NET-JQUERY_AJAX-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb223.js-13 and NET-SOCKET_IO-content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js-15 are jQuery's Ajax helper and the socket.io client inside versioned build chunks. A CRM that syncs contacts and message templates needs a websocket and HTTP calls, so this is expected surface rather than evidence of intent. The endpoint list supports that reading: app.wascript.com is the vendor's own service and api.statsigcdn.com is a feature-flag CDN. The rest of the list, including above.sm, below.sm, border.radius.circle, btn.glass and calls.function.arguments.delta, is CSS values and JavaScript property chains that the extractor read as hostnames. Those strings cannot resolve to anything.

The two obfuscation hits sit inside build artifacts. OBFUSCATION-LARGE_BASE64 fires on funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js, and OBFUSCATION-FUNCTION_INDIRECT fires on content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js. A base64 blob in a hashed bundle is common for embedded fonts, icons or small assets, and indirect function calls are a standard minifier output. Neither file carries a malware signature, and no credential, cookie or storage API use was flagged anywhere in the extension.

A sceptic has a fair case. A content script running on WhatsApp Web can read every message the user has open, the publisher is a bare email address ([email protected]) with no company behind the listing, the user base is 10, and a large base64 blob is exactly where a loader would hide a payload. That argument points at capability, and capability is not behaviour. The scanned files show no code path from that blob to eval, no calls to chrome.cookies or chrome.storage, and no destination outside the vendor's own backend and a statsig CDN. Two things would settle it: the decoded contents of ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js, and the content_scripts match patterns in the manifest, since nothing in this scan records the permissions the extension actually requests. Neither gap changes what the current evidence shows.

Zero malware signatures, zero credential-access findings, zero suspicious third-party destinations. The finding count is high because 754 code-quality notes and 405 harvested strings were counted, and because each bundled library produced its own matches in every chunk file.

Key Reasons

• Zero malware, malware-signature, secret, dependency and tool-poisoning matches across 1,184 findings.
• All 22 network findings are bundled library patterns (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) inside hashed versioned chunk files, consistent with a CRM syncing to its own backend.
• Only app.wascript.com and api.statsigcdn.com look like real destinations; entries such as border.radius.circle, btn.glass and above.sm are CSS values and property chains misread as domains.
• Both obfuscation hits (OBFUSCATION-LARGE_BASE64 in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js) sit in minified build artifacts and are not colocated with any signature.
• No impersonation signal: the name Primeira Classe and the store listing do not copy a known extension.

False Positive Considerations

• IoC extraction from minified JavaScript: CSS values and property chains parsed as hostnames (border.radius.circle, btn.glass, above.sm, below.sm)
• 754 code-smell findings generated by bundling standard JavaScript libraries
• Bundled jQuery and socket.io client triggering network rules in every chunk file
• Base64 strings and minifier function indirection flagged as obfuscation in build output

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 70%.