What our analysis found

Nextgo Zap: Seu Whatsapp Turbinado! is rated caution by Extension Auditor. Our code review reported 3 findings (2 high, 1 medium), led by remote code loading. It comes from a publisher with 51 extensions and was last updated in September 2026.

Key findings

• high· remote code loading —Every 10 minutes the background service worker fetches a JSON config from ` and forwards the full payload to the WhatsApp Web content script. The config contains a `remote_code` field (confirmed at line 377) that the content script uses to load additional JavaScript. Because the content script that processes this message is absent from the extracted bundle, the scope of code that can be injected into WhatsApp Web is unverifiable. This is a persistent remote-code-update vector that bypasses Chrome Web Store review after the initial publish.
• high· remote code loading —The `inject-code` message handler (line 446) calls `v()`, which treats the `remote_code` field in the remote config as a required URL for a WPP module. The error code `MODULO_EXTERNAL_NOT_INITIALIZED_IN_BACKGROUND` confirms the extension expects to dynamically load an external module into the WhatsApp Web page at runtime rather than relying solely on the bundled ` `. This allows the publisher to swap or augment the WhatsApp Web JavaScript execution context without a Chrome Web Store update, which is the mechanism attributes to credential harvesting in this extension.
• medium· unauthorized data collection —On installation, the extension reads the `bearer_token` URL parameter from any open Chrome Web Store tab. While this token appears to be the publisher's own CRM authentication token embedded in a referral link, reading arbitrary URL parameters from browser tabs across an unrelated origin () is an unusual cross-site data collection pattern. Combined with the remote-code mechanism, this token is subsequently injected into the WhatsApp Web URL (line 109, 393, 402) where the unverifiable content script reads it.

The background script hard-codes a remote-code update mechanism: every 10 minutes `f()` GETs ` and forwards the entire payload—including a `remote_code` URL field—to the WhatsApp Web content script via `Update_DomSelector` (:183–188). An `inject-code` internal message handler (line 446–447) explicitly triggers this fetch and errors with `MODULO_EXTERNAL_NOT_INITIALIZED_IN_BACKGROUND` if the `remote_code` field is absent, confirming the config drives dynamic code loading into WhatsApp Web. The primary content script file referenced by ` ` is absent from the extracted bundle, preventing direct confirmation of how `remote_code` is consumed. Corroborating signals: an independent IoC annotation from names this extension specifically as "WaSteal" (credential harvester), 93% of the permhash cluster is flagged malware, and the publisher email changed. Contradicting signals: all backend domains are subdomains of the publisher's own ` `, the 41-extension publisher portfolio has 0 malicious flags, and the bearer-token flow has a coherent CRM authentication explanation. The remote-code-loading architecture from a first-party domain is the primary unresolved concern.