What our analysis found

ViaShopModa is rated caution by Extension Auditor. Our code review reported 3 findings (3 high), led by remote code loading. It comes from a publisher with 18 extensions and was last updated in September 2026.

Key findings

• high· remote code loading —The config block explicitly names `remote_code` as the URL for remotely loaded code (`código remoto`). This is not a first-party domain matching the declared publisher domain (` `); it belongs to the underlying ` ` platform. Combined with the logic below, this constitutes a remote code loading channel allowing the platform operator to change the extension's behavior on WhatsApp Web at any time without a CWS update.
• high· remote code loading —Every 10 minutes (via the `Ten_Minutes` alarm, line 241) `f()` fetches ` and broadcasts the entire response object to all WhatsApp Web content scripts under the `Update_DomSelector` action. The content of this JSON is fully controlled by the remote server and can include any payload, including a new `remote_code` URL. Because the main content script file is absent from this extraction bundle, it is impossible to verify whether the content script uses this to dynamically load and evaluate additional JavaScript.
• high· remote code loading —The `v()` function is triggered by the `inject-code` message from the content script (line 447). It calls `f()` to refresh the remote config and explicitly extracts the `remote_code` URL field, then treats a missing URL as a fatal error (`MODULO_EXTERNAL_NOT_INITIALIZED_IN_BACKGROUND`). The error string confirms the intent: the URL returned by the remote server is the live injection point for the WPP module. Because the content-script side of this handshake is not in the extraction, the full injection chain cannot be audited.

The extension's contains a confirmed remote code loading pattern: it fetches ` every 10 minutes (line 183) and forwards the full config—including a `remote_code` URL—to the WhatsApp content script via `Update_DomSelector`, enabling the platform operator to silently alter extension behavior without a CWS update. The main content script (` `) is absent from the extraction bundle, making it impossible to audit what data is collected and sent to the five ` ` backend endpoints; the CWS declares zero data collection despite this being a full WhatsApp CRM with WppConnect integration. Corroborating signals include the internal IoC note classifying this as 'WaSteal' (, 2026-05-13), a 93% malware rate across 16,776 permhash peers, and a recorded publisher ownership change; the mitigating counterpoint is the publisher's 18 other clean extensions.