What our analysis found

WhaScale Oficial – Um passo à frente do seu concorrente showed no malicious code in Extension Auditor's review. It comes from a publisher with 51 extensions and was last updated in September 2026.

WhaScale Oficial is a WhatsApp Web CRM extension targeting Brazilian businesses. All network destinations resolve to *. (the publisher's own backend infrastructure, consistent with externally_connectable declarations and the published manifest). The large JS footprint is dominated by the bundled library (a well-known open-source WhatsApp Web automation library, 22K+ lines), which accounts for the elevated innerHTML, appendChild, and eval-related ML signals — the sole eval-like pattern, Function("return this")() at wpp_module line 161, is standard lodash global-scope detection, not dynamic code execution. The remote_code config key is fetched from and used only to send DOM selector updates to the content script via chrome.tabs.sendMessage; no remote script is fetched and evaluated. Publisher has zero malicious extensions out of 49, clean email reputation, and a matching bundled vs. published manifest with no discrepancies.