Security Alert: Malware Risk Confirmed
Z-API Conector
ID: iopmkohngoecmepoheapifkafbeomphn
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Four Pixel ITView Profile
- Privacy
- Privacy Policy
- Country
- BR
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- Av. MARAJO 190 Cianorte, PR 87207-008 BR
- Website
- Visit
Uma extensão que te ajuda a conectar de forma segura sua instância no Z-API.
Essa extensão tem o objetivo de facilitar clientes a conectar de forma segura sua conta a Ferramenta do Z-API.
The function uses `chrome.scripting.executeScript` to inject scripts into WhatsApp Web that read Signal Protocol private keys (`signal_static_privkey`), Noise Protocol keypair (including private key), ADV signed identity, recovery token, and the user's phone number from IndexedDB and localStorage. These are then base64-encoded and POSTed to `https://api.z-api.io/instances/extension-connect`. While the destination (z-api.io) matches the publisher's stated domain and this is the extension's core purpose, the CWS data-collection disclosure is 'none declared' — the user is not informed that their WhatsApp private cryptographic keys and authentication identity are being collected and transmitted to a third-party server. Private keys sent to any remote server enable that server to impersonate the WhatsApp account indefinitely.
async function buildConnectionPayload(tab) { const noise = await getNoise(tab); const me = await getItemLocalStorage(tab, "last-wid-md"); const registrationId = await getItemIndexDb( tab, "signal-storage", "signal-meta-store", "signal_reg_id", ); const ADVSignedIdentity = await getItemIndexDb( tab, "signal-storage", "signal-meta-store", "adv_signed_identity", ); const SignalStaticPrivKey = await getItemIndexDb( tab, "signal-storage", "signal-meta-store", "signal_static_privkey", true, ); const SignalStaticPubKey = await getItemIndexDb( tab, "signal-storage", "signal-meta-store", "signal_static_pubkey", true, ); return { noise: { pubKey: btoa(String.fromCharCode.apply(null, new Uint8Array(noise.staticKeyPair.pubKey))), privKey: btoa(String.fromCharCode.apply(null, new Uint8Array(noise.staticKeyPair.privKey))), }, me: me.replace(/\"/g, ""), registrationId, identityKeyPair: { privKey: btoa(String.fromCharCode.apply(null, new Uint8Array(SignalStaticPrivKey))), pubKey: btoa(String.fromCharCode.apply(null, new Uint8Array(SignalStaticPubKey))), }, account: { details: btoa(...), accountSignatureKey: btoa(...), accountSignature: btoa(...), deviceSignature: btoa(...) }, };}After the cryptographic credentials are successfully transmitted to api.z-api.io, the extension injects a script into WhatsApp Web that clears all localStorage and forces a page reload, destroying the user's local WhatsApp Web session. This occurs immediately after key transfer, leaving the user's browser without an active WhatsApp session while the credentials now reside on Z-API's servers. While arguably a consequence of session migration, this action is performed silently without explaining to the user that their local session will be terminated.
if (result.value || result.success) { showStep("step-success"); chrome.scripting.executeScript({ target: { tabId: currentTab.id }, function: () => { localStorage.clear(); location.reload(); }, args: [], }, () => {}, );}By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 3.0.0 | 2 |
Files with findings
1 distinct path — top paths by unique finding count:
- js/index.js2
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.