WA Bulk Message Sender

The extension is designed to automate sending bulk messages via WhatsApp Web. Its main purpose is to help users send messages to multiple contacts efficiently, likely for customer engagement or marketing.

Key Functionalities and API Usage:

• Uses Chrome extension APIs (e.g., chrome.runtime, chrome.storage.local, chrome.alarms, chrome.tabs) for background tasks, storage, and tab management.
• Interacts with WhatsApp Web by opening relevant tabs and possibly injecting scripts to automate message sending.
• Handles phone number formatting and country code detection using a phone number library.
• Implements a logging mechanism that collects usage and event data (such as user phone number, country code, browser info, etc.) and sends it to a remote server for analytics/logging purposes. This is done via HTTP POST requests to an endpoint at us-west-1.log.aliyuncs.com (Aliyun Log Service), with optional LZ4 compression.

Network Activity:

• Sends logs and usage data to a remote analytics endpoint, including potentially sensitive information (e.g., phone numbers, browser info, UUIDs). Example code:

fetch(r, {method: "POST", headers: t, body: o})

• No evidence of sending user message content or WhatsApp credentials to third-party servers.

Filesystem Activity:

• Uses chrome.storage.local to store and retrieve configuration and log data.

Process Execution:

• No evidence of executing external processes or code outside the extension context.

Obfuscation:

• The code is minified and bundled, but not obfuscated. Variable names are short, but logic is readable and not intentionally hidden or encrypted.

Backdoors/Data Exfiltration:

• The only data sent externally is for logging/analytics. There is no evidence of exfiltrating user messages, contacts, or WhatsApp credentials.

Code Execution:

• No evidence of arbitrary code execution, remote code loading, or eval usage.

Summary:

• The extension collects and sends usage analytics (including phone numbers and device info) to a remote server, which is typical for commercial extensions but should be disclosed to users. No strong indicators of malicious behavior or backdoors were found. The code is not obfuscated beyond standard minification/bundling.