IronZap

AI Security Review

Evidence context: threat category none; evidence quality moderate.

IronZap describes itself as a WhatsApp Web CRM, and the file layout matches that description: content/assets/js/ holds a set of versioned bundles (v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2xx.js files plus a funnil/assets/js/ chunk), and background.js carries the background logic. The network detections land on that code. Every hit is one of three rules: NET-JQUERY_AJAX, NET-SOCKET_IO and NET-FETCH. These rules match the presence of HTTP call sites, and the call sites here sit inside bundled third-party libraries, for example content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2148.js and content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2212.js carry socket.io, while content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2136.js and content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2178.js carry fetch. The one call site in the extension's own code is background.js:137, which a chat sync tool needs in order to move data between the browser and its backend.

Two findings are labelled as obfuscation. OBFUSCATION-LARGE_BASE64 points at funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js, a chunk name with a content hash. OBFUSCATION-FUNCTION_INDIRECT points at content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js. Indirect function invocation is routine output from any JavaScript minifier, and embedded base64 blocks are how bundlers inline fonts, icons and small modules. Neither hit comes with a malware signature, an IoC or an exposed secret, and the scan reported none of those anywhere in the package. A large base64 block sitting inside a hashed vendor chunk is a packaging detail.

What is absent carries weight here. No finding names a command-and-control host, no rule matched cookie or credential access, and no domain in the package resembles a bank, a mail provider or a social login page. The recorded manifest lists no host permissions and no API permissions at all, which points to a gap in the manifest data collected rather than to silent behaviour. A CRM that renders a panel over WhatsApp Web has to touch that page, so the empty permission list is a limit of this scan.

The strongest counterargument is the publisher. IronZap comes from [email protected], a generic address on a domain named for extension sales, with a very small user base and a large base64 blob in the package. Anonymous publishers with bundled code are exactly how many bad extensions look. That reading stalls on specifics: malicious packages almost always trip at least one malware or IoC rule, and this one trips none, while the detections that did fire are named library rules and minifier artefacts. The unresolved question is where the socket.io connection in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2148.js actually points, since no destination was captured. If runtime observation showed background.js sending WhatsApp message content to a host unrelated to the vendor, the picture would change. Short of that, these findings describe a chat-sync app using the libraries that chat-sync apps use.

Key Reasons

• No malware signature, IoC, secret, code-smell or tool-poisoning finding matched anywhere in the package; everything reported is medium severity.
• Every network detection is one of three library rules (NET-JQUERY_AJAX, NET-SOCKET_IO, NET-FETCH) firing inside bundled versioned files under content/assets/js/ and one call site in background.js:137.
• The two obfuscation hits, OBFUSCATION-LARGE_BASE64 in funnil/assets/js/ed6113f2-bc09-4421-a453-bbbd66fe9488.DCssQ7AT.js and OBFUSCATION-FUNCTION_INDIRECT in content/assets/js/v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb2259.js, match minifier and bundler output rather than hand-applied obfuscation.
• No external domain, login host or credential-access pattern appears in any finding, and the content-hashed filenames indicate build tooling rather than manual packing.

False Positive Considerations

• NET-JQUERY_AJAX, NET-SOCKET_IO and NET-FETCH fire on the presence of HTTP call sites, which any bundled chat or CRM front end contains.
• OBFUSCATION-LARGE_BASE64 matches inlined assets (fonts, images, small modules) emitted by webpack-style bundlers.
• OBFUSCATION-FUNCTION_INDIRECT matches indirect function invocation produced by JavaScript minifiers.
• Hashed filenames such as v_7_4_3_86_085ff17f-7684-4a41-bfdd-8bd9d5293bb212.js are build artifacts, and bundled vendor code multiplies library-level detections.

Reviewed 2026-10-10; recommended action: suppress false positive; model confidence 75%.