guruwa

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What the code does

guruwa bills itself as a CRM for WhatsApp Web, and the file layout matches that job. Content scripts under content/assets/js/ run on the WhatsApp page, hold chat state, and move data to and from a backend. background.js:137 carries a NET-FETCH finding, and the NET-SOCKET_IO hits at content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15 and content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289149.js:64 point at a persistent socket connection, which is how a CRM keeps an inbox in sync without polling. The manifest declares no permissions and no host permissions, so the extension holds no cookie access, no downloads access, and no reach into other tabs.

The network picture

The endpoint list mixes three things. app.wascript.com belongs to the product, and api.statsigcdn.com serves feature flags, a normal SaaS dependency. api.atlassian.com and api.atlassian-us-gov-mod.com arrived with a bundled library. The rest of the list is extractor noise: above.sm, below.sm, btn.glass, border.radius.circle, color.border.accent.orange and calls.function.arguments.delta are CSS design tokens and minified property chains, not hosts. That pattern explains the 410 indicator hits as well.

Obfuscation findings

Two medium obfuscation flags deserve a look. OBFUSCATION-LARGE_BASE64 in funnil/assets/js/9cf42769-2ad5-4714-8614-9a2b4c455349.CgnacD38.js marks a base64 blob inside a hashed build artifact; bundled images, fonts and vendor bundles produce this constantly. OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d289260.js marks indirect calls, which a minifier emits. Neither flag sits next to a malware signature, and the co-location rule is the one that matters.

The counterargument

A skeptic would point at the raw numbers: 1,189 findings, 22 network hits, 410 indicators, and a directory named funnil holding a random-looking filename. On a dashboard that looks alarming. It falls apart on inspection. Malware signature count is zero. Of the 1,189, some 754 are code-smell matches of the kind that fire on any non-trivial JavaScript, and 410 are indicator hits dominated by strings the extractor read as domains. Nothing here reaches a login page, harvests cookies, or connects anywhere unrelated to running a WhatsApp inbox. The extension does read chat content, and anyone weighing the install should know that, because that access is the product. Reading chats is the whole point of a CRM for WhatsApp Web.

What would change this

A malware signature in the same file as the base64 blob, a request sending message bodies somewhere other than the product backend, or a socket connection to a host outside app.wascript.com and its analytics. None of those appear in this bundle.

Key Reasons

• Zero malware signatures and zero malware findings across 1,189 total findings
• Network findings (NET-FETCH in background.js:137, NET-SOCKET_IO in content/assets/js/v_7_4_3_87_0a650f0a-57a6-4989-860e-3a9d8748d28912.js:15) match a chat sync backend, not exfiltration
• Most listed endpoints are extractor artifacts, such as color.border.accent.orange and calls.function.arguments.delta, which are CSS tokens and minified property chains
• The remaining third-party endpoints, api.statsigcdn.com and api.atlassian.com, belong to bundled libraries and analytics
• Manifest declares no permissions and no host permissions for an extension that only operates on the WhatsApp Web page

False Positive Considerations

• 754 low-severity code-smell matches firing on minified and bundled JavaScript
• 410 IoC hits dominated by CSS design tokens and minified property chains misread as domains
• LARGE_BASE64 obfuscation flag on a hashed build asset that likely holds an image or font
• Bundled vendor library artifacts pulling in unrelated third-party endpoints such as api.atlassian.com

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 72%.