What our analysis found

YOUSELLER - Facilidade, produtividade em escala. is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by remote code loading. It comes from a publisher with 51 extensions and was last updated in September 2026.

Key findings

• high· remote code loading —Every 10 minutes the background worker fetches ` and forwards the full JSON response to all WhatsApp Web content scripts via `Update_DomSelector`. The JSON object contains a `remote_code` field (a URL to external JavaScript) which `v()` extracts at line 377 for use by the content script. This is a server-controlled update channel that can silently push new selector logic or code to run inside WhatsApp Web without shipping a new extension version, bypassing Chrome Web Store review. The variable is named `remote_code` (not `remote_config`) in source comments ('// Url do código remoto') confirming the author's intent.
• medium· credential theft —On installation, `y()` silently reads URL parameters (including `bearer_token`) from any open Chrome Web Store tabs using `chrome.tabs.query`. The extracted token is then injected as a query parameter when opening WhatsApp Web. While this appears to be the YOUSELLER authentication flow, the mechanism — reading URL parameters from CWS tabs and routing them through WhatsApp — is the type of credential relay pattern consistent with the MalExt 'WaSteal' report: the content script running at ` ` would be the only party able to read and forward this token.

The extension fetches a remote ` ` from ` every 10 minutes (:183-190) and forwards the result — which contains a field explicitly named `remote_code` (extracted by `v()` at line 377) — to WhatsApp Web content scripts. This is a remote code update channel that bypasses Chrome Web Store review. An independent threat intelligence IoC from MalExt (added 2026-05-13) specifically names this extension family 'WaSteal,' and 93% of extensions sharing the exact same permission set are flagged as malware in our own database — both strongly corroborating signals. The publisher's malicious record and a 5-star rating provide weak counterweight given the IoC and the remote-code architecture.