Chrome Web StoreCaution required
Suspicious in code review (v7.4.3.50)
Our reviewer found behaviour consistent with malware in version 7.4.3.50, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
Disparô/Wa - Disparo no WhatsApp, CRM, Automações, Ferramen… is rated caution by Extension Auditor. Our code review reported 3 findings (2 high, 1 medium), led by remote code loading. It comes from a publisher with 20 extensions and was last updated in October 2026.
Key findings
- High
Remote Code Loading
Every 10 minutes the background service worker fetches `[domain withheld] and forwards the parsed JSON—including an explicit `remote_code` URL—to all content scripts running inside `[domain withheld] via the `Update_DomSelector` message. The handler for that message lives in the main content script (`v_7_4_3_50_... `) which is absent from the extracted bundle; without it, it is impossible to confirm whether the received `remote_code` value is used only as a DOM-selector map or is also used to dynamically load and execute remote JavaScript inside the WhatsApp Web page context. This pattern is a well-documented remote code update vector in MV3 extensions.
- High
Remote Code Loading
The `inject-code` runtime message (line 447) triggers `v()`, which fetches the remote config and validates that the `remote_code` field is present. The function name, the message name, and the explicit `remote_code` field check together name this pathway as a code-loading mechanism. Although `v()` itself does not call `eval` or create a script element, the pattern—content script requests injection, background retrieves remote URL, config including that URL is dispatched back—is consistent with a dynamic loader that has been split across the missing content-script handler to evade static analysis.
- Medium
Credential Theft
The background actively queries open `[domain withheld]` tabs and harvests a `bearer_token` URL parameter. While this is ostensibly part of the publisher's own SaaS auth redirect flow ([domain withheld] → CWS install page → extension reads token), the `tabs` permission and this scraping pattern give a post-compromise attacker (or a new owner after the recorded email hand-off) a ready-made mechanism to capture OAuth-style tokens present in any CWS tab the user has open at install time. Combined with the recorded ownership change, this is an elevated-risk credential-adjacent pattern.
Analyst notes
The available code is consistent with a legitimate WhatsApp CRM using WPPConnect, but two concrete patterns cannot be cleared without the main content script (missing from bundle): (1) ` ` fetches a remote JSON config from `[domain withheld] every 10 minutes and sends the entire result—including an explicit `remote_code` URL field—to content scripts running inside `[domain withheld] via `Update_DomSelector`; without seeing the handler in the missing `v_7_4_3_50_... ` file it is impossible to determine whether that URL is used to dynamically load and execute JavaScript in the WhatsApp Web page context. (2) An `inject-code` message handler calls `v()` which reads `remote_code` from that same remote config—a named code-loading indirection—corroborating the remote execution vector. The dedicated IoC from [domain withheld] ("WaSteal", added 2026-05-13) and a recorded publisher change strongly support suspicion and contradict the otherwise-clean publisher reputation; the 93% malware rate in the identical permission cluster further corroborates concern.
Disparô/Wa - Disparo no WhatsApp, CRM, Automações, Ferramentas para Venda Chrome extension security report
ID: jhokpeoaapahcoaigkfnienliabeaang
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- ewdht
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Email Change History
Screenshots & videos
Install growth
About this extension
Disparô/Wa é um CRM para WhatsApp Web. Organize seus chats e otimize seus negócios no WhatsApp Web
Read the publisher’s full description
Com novas funcionalidades para WhatsApp web, você pode ter mais controle sobre seus leads além de prospectar mais clientes com envios em massa e exportação de contatos na Disparô/Wa. Crie um verdadeiro funil de CRM para vender mais. Características: ✔ Envio em massa para seus contatos ou contatos importados por CSV ✔ Crie Abas personalizadas, encontre facilmente seus contatos importantes Visão Kanban dos contatos do WhatsApp organize seus leads ✔ Envie mensagens para um número que não esteja na sua agenda ✔ Crie notas para cada contato dentro do contato ✔ Você tem que ligar de volta? Crie lembretes para cada contato ✔ Agende Reuniões no google agenda direto ✔ Crie lembretes de forma simples e seja notificado ✔ Crie um banco de respostas rápidas para enviar com um clique ✔ Exporte todos seus contatos ou contatos de grupos ✔ Use em seu idioma nativo (português, espanhol, inglês) ✔ Borre as mensagens para criar vídeos tutorias ✔ Assistente AI — Sua inteligência artificial pronta para ajudar! Otimize seu tempo com um assistente inteligente, rápido e sempre disponível. Responda dúvidas, automatize tarefas, gere textos, traduções e muito mais com o poder da IA. Ideal para profissionais, equipes e quem busca praticidade no dia a dia. Importante: ✔ Aprovado na auditoria de segurança do Google Chrome ✔ Não usa banco de dados, tudo acontece no seu computador. Disparô/Wa é uma extensão independente do Chrome que adiciona recursos extras ao seu WhatsApp web, não fazemos parte do WhatsApp Inc., não temos contrato de uso ou licenças exclusivas
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from ewdht
Popular in productivity/tools
- 迅雷下载支持86,000,000 users
- Torrent Scanner8,000,000 users
- AnyDoc Translator - Translate Web and PDF6,000,000 users
- IE Tab4,000,000 users
- Nimble capture1,000,000 users