What our analysis found

WaBest is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by unauthorized data collection. It comes from a publisher with 20 extensions and was last updated in September 2026.

Key findings

• medium· unauthorized data collection —4532 installs a WPP 'chat.new_message' listener that forwards the entire message model - text plus the author's phone number, including LID-to-phone resolution via ApiContact.getPhoneNumber - as a WPP-EVENTS message, automatically for every inbound message with no user action and no content filter; chat.active_chat and chat.update_label are relayed the same way. This branch then rebroadcasts that payload to every port in the set `s`, which is populated by both chrome.runtime.onConnect and chrome.runtime.onConnectExternal (:501), with no check on the receiving port's origin. Because externally_connectable admits, and the developer host, any page on those vendor-controlled origins that opens a port receives the user's WhatsApp message contents, and the CWS listing declares no data collection whatsoever, so this content flow is entirely undisclosed.

WaBest is a genuine Portuguese-language WhatsApp Web CRM white-label ('name: "watidy"',:23) built on unmodified upstream v4.6.1-alpha.0, and nearly every ML regex signal (11 MB of JS, fromCharCode,, appendChild) is that vendored library plus chunks, not authored obfuscation; the eval and atob hits in are the library's eval("require")("stream") bundler dodge and a data-URI parser. HTTP egress in this bundle is limited to pings to the vendor's own carrying only, plus a ten-minute GET of from (:188-198) that sends no user data and whose response is relayed to the page as Update_DomSelector JSON rather than executed - the 'remote_code' label is a DOM-selector config URL, and the inject-code handler D() (:383-394) only checks that the field is present, so there is no remote code execution in the code I have. What keeps it off a benign verdict is the port hub::4532 relays every inbound WhatsApp message object ( plus resolved author phone number) into WPP-EVENTS, and:457 rebroadcasts it to every registered port with no origin filter, while ports can also be opened by chrome.runtime.onConnectExternal (:501) from, and the developer host, and the CWS listing declares no data collection at all. Signals: the ML score, the 96%-malicious permhash cluster and the IoC note are one correlated signal over what is almost certainly this white-label family, contradicted by the publisher's clean record ( malicious), a valid business domain, a chrome-stats impact of only, and a bundled manifest whose permissions match the published listing exactly; confidence is capped at medium because the bundle holds 9 of 386 files and the three main content chunks imported at:62-67 are absent.