What our analysis found

WA Envio is rated caution by Extension Auditor. Our code review reported 3 findings (2 high, 1 medium), led by remote code loading. It comes from a publisher with 20 extensions and was last updated in September 2026.

Key findings

• high· remote code loading —Every 10 minutes the background service worker silently fetches ` (a domain named 'code') and forwards the full parsed response to the WhatsApp Web content script via the `Update_DomSelector` message. The response includes a `remote_code` property. If the content script evaluates or dynamically imports that URL, this constitutes a live remote-code-update channel that bypasses extension review entirely. The main content module that handles this message is absent from the analysis bundle, preventing confirmation.
• high· remote code loading —The `inject-code` internal message triggers `v()`, which fetches the external config and validates the presence of the `remote_code` URL. The error message 'MODULO_EXTERNAL_NOT_INITIALIZED_IN_BACKGROUND' indicates this is intentionally used to bootstrap an external module. Combined with the server being at ` `, the naming strongly implies the config carries executable code or a URL to dynamically loaded JS, rather than mere CSS-selector configuration.
• medium· other —The bundled manifest declares `externally_connectable` for two external origins (` ` and ` `), which is absent from the published CWS manifest summary. This field allows those web pages to send messages directly to the extension's background service worker without user interaction. While the domain is the publisher's own, the undisclosed ` ` origin is unexpected and the absence from the published listing is a material mismatch.

contains an explicit remote-code-loading pipeline: function `f()` (line 183) fetches ` every 10 minutes and forwards the response — which includes a `remote_code` property — to the WhatsApp Web content script via `Update_DomSelector`; a separate `inject-code` message handler (line 446) additionally triggers `v()` which reads that same `remote_code` URL from the config. The main content module that processes these messages (` `) is absent from the analysis bundle, so actual execution of remote code cannot be confirmed or refuted. The ML score and 93% permhash-cluster malware rate corroborate suspicion, as does an IoC from ('WaSteal'), and a documented publisher ownership change; counterbalancing signals are the publisher's malware rate on other extensions, all visible network calls targeting first-party subdomains, and the extension's 2.5-year age.