Transfer of Ownership

Flag items where ownership has been transferred to a different publisher, which may indicate compromise or changes in trustworthiness.

medium

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

medium

Individual Publisher

Flags items published by individuals rather than verified companies or organizations, indicating potential risks due to limited accountability and unclear operational standards

low

Extension Purpose and Intention

Master Engage is a Chrome extension designed to enhance WhatsApp Web functionalities. It aims to provide users with CRM-like features, enabling mass messaging, contact management, and scheduling directly from WhatsApp Web.

Code Insights

• API Calls and Network Activity:
  • The extension makes several network requests to predefined URLs for various functionalities:
    • https://painel.wascript.com.br/ and related endpoints for backend operations.
    • https://domselector.watidy.com/index.php for fetching DOM selector updates.
    • https://app.watools.com.br/api/public/waTidy-logs for logging errors.
  • Uses fetch API to retrieve data from these endpoints.
• Local Storage and Data Handling:
  • Utilizes chrome.storage.local to store and retrieve user data, including notifications, contacts, and settings.
  • Example of data retrieval:

    chrome.storage.local.get([e], function(s) {
      s[e] === void 0 ? o() : t(s[e]);
    });
    ```
- **Alarms and Scheduling**:
  - Sets up periodic alarms using `chrome.alarms` to trigger updates and notifications.
  - Example of alarm setup:

chrome.alarms.create("One_Minute", { periodInMinutes: 1 });
```

• Tab Management:
  • Queries and manipulates Chrome tabs to ensure WhatsApp Web is open and reloads it if necessary.
  • Example of tab query:

    chrome.tabs.query({ url: "https://web.whatsapp.com/*" }, function(e) {
      e.length > 0 && e[0].id !== void 0 ? chrome.tabs.reload(e[0].id) : chrome.tabs.create({ url: "https://web.whatsapp.com" });
    });
    ```
- **User Interaction and Notifications**:
  - Sends messages to content scripts using `chrome.tabs.sendMessage` for updating notifications and other actions.
- **Installation and Uninstallation Hooks**:
  - On installation, it makes a network request to register the installation event.
  - Sets an uninstall URL to track when the extension is removed.

### Potential Malicious Indicators

- **Network Requests**: Frequent network requests to external servers could indicate data exfiltration, but in this context, they appear to be for legitimate functionality.
- **Data Storage**: Extensive use of local storage for user data management, which is typical for CRM functionalities.
- **No Obfuscation Detected**: The code is not obfuscated, suggesting transparency in its operations.

### Conclusion

The extension appears to be designed for enhancing WhatsApp Web functionalities with CRM features. The network activity and data handling align with its stated purpose, and no strong indicators of malicious behavior were observed.

### Compliance

Compliance status and certifications for the extension and its publisher

Extensao.store

The website extensao.store has declared that they achieved ISO 27001 certification in December 2023, confirming their compliance with this standard. There is no indication of a parent company or any mention of its compliance status.

Compliant

### Licenses

No license text available...

See More