Is Whato - CRM para Whatsapp & Automatización de mensajes safe?

Analysis summary

Malware versions

3.0.2.43

malware

3.0.2.42

malware

3.0.2.41

malware

Findings

Malicious Activity Detected

Flags items that exhibit confirmed malicious activity.

critical

Evidence

This item is flagged as software intended to perform unwanted or harmful actions within a system, often without the knowledge or consent of those affected. It can disrupt normal operations, compromise data, or enable unauthorized access.

Removed from Marketplace

Flags items that have been removed or delisted from the marketplace, potentially due to security vulnerabilities, or malicious behavior. Such extensions pose a risk as they are no longer maintained or patched.

high

Identity & Authentication Permissions

Flags items that request access to user identity or authentication flows. These capabilities may expose session credentials or login behavior, increasing the risk of impersonation, session hijacking, or unauthorized account access.

medium

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

This Chrome extension is designed to enhance WhatsApp Web with CRM and marketing automation features. Its main intention is to interact with WhatsApp Web tabs, manage notifications, and handle Google authentication for user data integration.

Key Functionalities:

On install or action click, it opens or reloads WhatsApp Web tabs.
Listens for specific messages to perform actions such as modifying HTTP headers, blocking or redirecting certain requests, and updating dynamic rules via chrome.declarativeNetRequest.
Handles Google authentication tokens and can fetch user info from Google APIs if requested.
Sends rich notifications and responds to notification clicks by focusing WhatsApp Web.

API Calls & Network Activity:

Uses chrome.declarativeNetRequest to modify, block, or redirect requests to WhatsApp Web and related domains. This is used to adjust Content Security Policy headers, block certain scripts, and manage CORS headers.
Fetches data from Google APIs when authorized by the user.
Makes generic API requests via a helper function for backend communication.

Filesystem/Process Execution:

No direct filesystem or process execution is present.

Obfuscation:

The code is minified but not obfuscated. Variable names are short, but logic is readable and not intentionally hidden.

Potentially Sensitive Operations:

The extension can fetch Google user info if the user authorizes it, but this is a standard OAuth flow and not hidden.
Modifies security headers on WhatsApp Web, which could potentially weaken security but is likely necessary for the extension's features.

No strong indicators of malicious activity were observed.

Permissions

high

declarativeNetRequest

api

Enables network request filtering using predefined rules without requiring direct access to request content.

high

identity.email

api

Allows the extension to access the user's email address associated with their browser profile or account.

low

identity

api

Allows user authentication with web services, potentially accessing connected accounts through the browser.

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

API CALLS ARE AVAILABLE FOR ENTERPRISE USERS

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

SECRETS ARE AVAILABLE FOR ENTERPRISE USERS

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://wppc-linkpreview.cloudtrix.com.br

injectScript.bundle.js

https://wawf-space.nyc3.digitaloceanspaces.com/918160748516/2025-01-07/wwwbucket/1736226950314-615ac061-3b43-4478-8aa2-bdd63b4f496f.png

injectScript.bundle.js

https://wawf-space.nyc3.digitaloceanspaces.com/918160748516/2025-01-07/wwwbucket/1736227109400-2a215706-b38f-4c74-bf96-cf31338c8a26.png

injectScript.bundle.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

jquery

Version:

3.7.1

jszip

Version:

3.10.1

moment.js

Version:

2.30.1

All dependencies are available for Enterprise users

Licenses & Compliance

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

LICENSES & COMPLIANCE ARE AVAILABLE FOR ENTERPRISE USERS