zapboost

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Zapboost describes itself as a CRM for WhatsApp Web, claiming to organize chats and optimize business workflows. The extension is published by [email protected], a generic email address with no company attribution, and has 6 users on the Chrome Web Store.

The scanning results contain 1203 total findings, but the vast majority are noise. The findings summary shows 754 code-smell findings at low severity, which match standard JavaScript patterns and fire on virtually any non-trivial code. The 424 IoC findings are similarly uninformative. The extracted network endpoints include CSS design tokens like "border.radius.circle" and "color.border.accent.orange", code patterns like "calls.function.arguments.delta", and country-code TLDs like "ae.jobs" and "af.pf". These are hex substrings and property access chains misidentified as domains by the IoC extractor, not real network endpoints.

The 22 network findings all reference standard web APIs. Files like content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb224.js trigger NET-JQUERY_AJAX findings, while content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js triggers NET-SOCKET_IO. These findings indicate the extension uses jQuery for AJAX requests and Socket.IO for real-time communication, which is expected for a chat CRM application. The background.js file triggers a NET-FETCH finding at line 137, indicating it makes HTTP requests, but no suspicious destination domains are identified.

The only findings warranting attention are the 2 obfuscation detections. The file funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js contains large base64-encoded data, triggering an OBFUSCATION-LARGE_BASE64 finding. The directory name "funnil" is unusual for a WhatsApp CRM extension. The file content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js triggers an OBFUSCATION-FUNCTION_INDIRECT finding, indicating indirect function calls that can obscure code logic. These obfuscation findings are medium severity and appear in the absence of any malware signatures, which makes their intent unclear.

The extension declares no host_permissions and no permissions in the manifest, which is unusual for an extension claiming to integrate with WhatsApp Web. A legitimate WhatsApp Web CRM would typically require host permissions for web.whatsapp.com to read and modify chat content. The absence of these permissions raises questions about whether the extension actually functions as described.

A skeptic would argue that this is simply a small, early-stage extension from an independent developer in Brazil. The Portuguese description and .store TLD suggest a Brazilian developer. The "funnil" directory could be a marketing funnel module, the base64 could be embedded assets like images or fonts, and the function indirection could be an artifact of the build process. The low user count of 6 could indicate the extension is new or in testing. Without malware signatures or specific suspicious domains, there is no definitive evidence of malicious intent.

This counterargument has merit. The bulk of the findings are demonstrably false positives, and the extension's described purpose legitimately requires the networking patterns observed. However, the combination of an anonymous developer, no declared permissions, obfuscation in an unusual directory, and only 6 users creates enough ambiguity that runtime analysis is needed to determine whether the extension behaves as advertised.

Key Reasons

• Two obfuscation findings in funnil/assets/js/ and content script without malware signatures
• Anonymous developer ([email protected]) with only 6 users
• No host_permissions declared despite claiming WhatsApp Web integration
• 754 code-smell findings and 424 IoC findings are demonstrably false positives
• Network findings show standard API usage (jQuery, Socket.IO, Fetch) expected for a chat CRM

False Positive Considerations

• 754 code-smell findings matching standard JavaScript patterns
• 424 IoC findings including CSS properties and code patterns misidentified as domains
• 22 network findings referencing standard web APIs (jQuery AJAX, Socket.IO, Fetch)

Reviewed 2026-10-10; recommended action: runtime analysis; model confidence 62%.