Transfer of Ownership

Flag items where ownership has been transferred to a different publisher, which may indicate compromise or changes in trustworthiness.

medium

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

medium

Low Install Count

Flags items lacking installs on the marketplace, suggesting concerns about the extension's reputation and the publisher's reliability.

low

Extension Purpose and Intention

The WaMed Chrome extension is designed to enhance the functionality of WhatsApp Web by providing additional features such as mass messaging, contact management, and CRM capabilities. It aims to help users manage leads and prospects more efficiently.

Key Functionalities and Code Insights

  • Mass Messaging: The extension allows users to send messages to multiple contacts, including those imported via CSV files.
  • Contact Management: Users can create custom tabs, add notes to contacts, and set reminders for follow-ups.
  • Scheduling and Notifications: The extension integrates with Google Calendar for scheduling meetings and sends notifications directly through WhatsApp Web.
  • Data Export: Users can export their WhatsApp contacts or group contacts.
  • Language Support: The extension supports multiple languages, including Portuguese, Spanish, and English.

API Calls and Network Activity

  • Backend Communication: The extension communicates with various backend services hosted on wascript.com.br for functionalities like multi-attendance, WhatsApp API, and audio transcription.
const u = {
    backend: "https://painel.wascript.com.br/",
    backend_utils: "https://backend-utils.wascript.com.br/",
    webSocket: {
      "multi-atendimento": "https://multi-atendimento.wascript.com.br",
      "api-whatsapp": "https://api-whatsapp.wascript.com.br"
    }
};
  • DOM Selector Update: Fetches updates from a remote server to ensure the extension's DOM selector is up-to-date.
async function l() {
    try {
      const t = await (await fetch(u.domSelector)).json();
      if (typeof t == "object" && typeof t.version == "string") {
        n("https://web.whatsapp.com/*", "Update_DomSelector", { version: t.version });
      }
    } catch (e) {
      console.error("Error ao tentar Capturar o Dom Selector virtual", e);
    }
}

Process Execution and Alarms

  • Alarm Management: The extension sets up periodic alarms to trigger updates and notifications.
function i() {
    chrome.alarms.get("One_Minute", e => { ... });
    chrome.alarms.get("Five_Minutes", e => { ... });
}

Storage and Data Handling

  • Local Storage: Utilizes Chrome's local storage to manage user data such as contacts, notifications, and settings.
async function d() {
    chrome.storage.local.get(null, e => {
      chrome.storage.local.set({ ... });
    });
}

Potential Malicious Indicators

  • Network Requests: The extension makes several network requests to external servers, which could potentially be used for data exfiltration if not properly secured.
  • Uninstall URL: Sets an uninstall URL to track when the extension is removed, which is a common practice but should be noted.
function f() {
    chrome.runtime.setUninstallURL(`https://painel.wascript.com.br/api/urls/uninstalURL?id=${chrome.runtime.id}`);
}

Conclusion

The WaMed extension appears to be primarily focused on enhancing WhatsApp Web functionality with CRM features. While it makes several network requests, these are consistent with its stated functionalities. There are no strong indicators of malicious behavior, but the reliance on external servers for core functionalities should be monitored for security.

Compliance

Compliance status and certifications for the extension and its publisher

Extensao.store

The website extensao.store has declared that they achieved ISO 27001 certification in December 2023, confirming their compliance with this standard. There is no indication of a parent company or any mention of its compliance status.

Compliant

Licenses

No license text available...