What our analysis found

WaPROdy is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by remote code loading. It comes from a publisher with 18 extensions and was last updated in September 2026.

Key findings

• high· remote code loading —Every 10 minutes the background fetches a JSON config from the external domain ` ` and pushes the entire payload to the WhatsApp Web content script via `Update_DomSelector`. The config is expected to contain a `remote_code` URL (extracted and validated in `v()` at line 374). Because the main content bundle is absent from this package, it cannot be confirmed that the content script does not fetch and execute the URL supplied in `remote_code`, but the named handler and field make this the designed injection vector. The extension's CWS listing, manifest, and privacy policy make no disclosure of remote code loading behavior.

fetches ` every 10 minutes (line 183), delivers the full payload—including a `remote_code` URL field—to content scripts via `Update_DomSelector`, and the `inject-code` message handler (line 446-447) explicitly calls `v()` which validates and resolves this `remote_code` URL; this is a remote code provisioning channel whose consumer (the main content bundle, 317 JS files) is absent from the analysis package. An independent IoC from (added 2026-05-13) explicitly labels this extension 'WaSteal,' a publisher email change was recorded, and 93% of extensions sharing this permission cluster are flagged as malware—all corroborating the ML verdict. The visible code alone is consistent with a legitimate WhatsApp CRM, but the missing content bundle and the named IoC prevent clearing the extension; direct confirmation of payload execution requires the absent files.