Chrome Web StoreCaution required
Suspicious in code review (v7.4.3.55)
Our reviewer found behaviour consistent with malware in version 7.4.3.55, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
ZarpGo is rated caution by Extension Auditor. Our code review reported 3 findings (2 high, 1 medium), led by remote code loading. It comes from a publisher with 20 extensions and was last updated in October 2026.
Key findings
- High
Remote Code Loading
Every 10 minutes (Ten_Minutes alarm) the background service worker fetches `[domain withheld] and broadcasts the entire response as an `Update_DomSelector` message to all open WhatsApp Web tabs. The config payload contains a `remote_code` field (a URL), and the missing primary content script almost certainly fetches and evaluates code from that URL — a textbook remote-code-loading pattern that bypasses Chrome Web Store review. If the publisher's server is compromised or malicious, arbitrary JS can be executed inside WhatsApp Web with full access to the user's messages, contacts, and session.
- High
Other
The bundled manifest declares `externally_connectable` for `[domain withheld]` and `[domain withheld]`, granting those web origins the ability to send arbitrary messages (including `user_auth` with `bearer_token`) directly into the extension's background script via `chrome.runtime.sendMessage`. This stanza is entirely absent from the published CWS manifest summary, indicating either a delayed-malicious update or a metadata discrepancy that CWS reviewers did not see. The `[domain withheld]` origin is also a commented-out fallback for the `remote_code` URL, tightening the connection between the two concerns.
- Medium
Other
The background script scans all open Chrome Web Store tabs (`[domain withheld]`) looking for a `bearer_token` URL parameter, then injects it into WhatsApp Web by navigating to `[domain withheld]>`. While this can be a publisher-designed SSO flow (CWS page redirected from the app with a token), reading arbitrary URL parameters from CWS tabs is non-standard and means any bearer token that appears in a CWS tab URL (e.g., after an OAuth redirect from a third-party site) is silently extracted and sent to the extension's backend. This pattern is atypical for legitimate WhatsApp CRM products.
Analyst notes
The extension's reveals three compounding concerns: (1) a remote-code-loading mechanism that fetches `[domain withheld] every 10 minutes and distributes a `remote_code` URL to all WhatsApp Web content scripts — enabling the publisher to push executable configuration outside the CWS review process; (2) the bundled manifest contains an `externally_connectable` stanza allowing `[domain withheld]` and `[domain withheld]` to inject `user_auth`/`bearer_token` messages into the extension that are not reflected in the published CWS manifest summary; (3) the extension internally identifies itself as 'watidy' (:23) despite being listed as 'ZarpGo', combined with a recorded publisher change and a [domain withheld] 'WaSteal' IoC added 2026-05-13. The publisher's other 19 extensions are clean (0% malice) and all backend domains are consistently `*.[domain withheld]`, which somewhat softens the signal; however, the remote code loading mechanism, identity mismatch, and explicit WaSteal IoC are not explained away by legitimate CRM functionality. The primary content script (~300 JS files totalling 10 MB) was not available for inspection, making it impossible to confirm active exfiltration — hence `suspicious` rather than `likely_malicious`.
ZarpGo Chrome extension security report
ID: jcjodbceolndbhnbljiedcanmglmhmop
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- ewdht
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Email Change History
Screenshots & videos
Install growth
About this extension
ZarpGo é um CRM para WhatsApp Web. Organize seus chats e otimize seus negócios no WhatsApp Web
Read the publisher’s full description
Com novas funcionalidades para WhatsApp web, você pode ter mais controle sobre seus leads além de prospectar mais clientes com envios em massa e exportação de contatos na ZarpGo. Crie um verdadeiro funil de CRM para vender mais. Características: ✔ Envio em massa para seus contatos ou contatos importados por CSV ✔ Crie Abas personalizadas, encontre facilmente seus contatos importantes Visão Kanban dos contatos do WhatsApp organize seus leads ✔ Envie mensagens para um número que não esteja na sua agenda ✔ Crie notas para cada contato dentro do contato ✔ Você tem que ligar de volta? Crie lembretes para cada contato ✔ Agende Reuniões no google agenda direto ✔ Crie lembretes de forma simples e seja notificado ✔ Crie um banco de respostas rápidas para enviar com um clique ✔ Exporte todos seus contatos ou contatos de grupos ✔ Use em seu idioma nativo (português, espanhol, inglês) ✔ Borre as mensagens para criar vídeos tutorias ✔ Assistente AI — Sua inteligência artificial pronta para ajudar! Otimize seu tempo com um assistente inteligente, rápido e sempre disponível. Responda dúvidas, automatize tarefas, gere textos, traduções e muito mais com o poder da IA. Ideal para profissionais, equipes e quem busca praticidade no dia a dia. Importante: ✔ Aprovado na auditoria de segurança do Google Chrome ✔ Não usa banco de dados, tudo acontece no seu computador. ZarpGo é uma extensão independente do Chrome que adiciona recursos extras ao seu WhatsApp web, não fazemos parte do WhatsApp Inc., não temos contrato de uso ou licenças exclusivas
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from ewdht
- Chatweb CRM : Transforme seu whatsapp em um sistema de vendas977 users
- Disparô/Wa - Disparo no WhatsApp, CRM, Automações, Ferramentas para Venda624 users
- Whats Expert205 users
- CRM DE ELITE : CRM no whatsapp, Automações e Ferramentas para venda200 users
- Win7max - CRM no WhatsApp Web, Chatbot, Automação e Disparo em Massa169 users
Popular in Tools
- Claude20,000,000 users
- Zotero Connector9,000,000 users
- ChatGPT8,000,000 users
- Browsec VPN - Free VPN for Chrome8,000,000 users
- WPS PDF - Read, Edit, Fill, Convert, and AI Chat PDF with Ease7,000,000 users