Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Easy WhatsApp contact export [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Gmail developer with no verified publisher status; unconfirmed owner of WhatsApp brand mention (impersonation flag).
• Extension accesses WhatsApp Web DOM via scripting — can read contact data.
• Privacy policy discloses third-party sharing without scoping retention period.
• Very low install count (3) with free-webmail dev email raises tail-attack-surface concern.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer domain gmail.com, confirmed_owner=false for WhatsApp brand.
• free_webmail_developer store Developer email nakulrathoreplus@gmail.com; no verified publisher badge.
• host_permission_whatsapp manifest host_permissions=[https://web.whatsapp.com/*]; scripting can read contact/message DOM.
• privacy_policy_third_party_sharing api Policy fetched, scope_extension=true, data_collection=false, third_party_sharing=true, retention=false.
• no_cve_no_obfuscation crx cve_findings_raw=[], obfuscation_score=0.0, code_findings_raw=[], 3 JS files scanned.
• operator_cluster_singleton api sibling_count=0; no related extensions under same fingerprint.
• threat_intel_clean api bad_host_hits=[], monetization_hits=[], affiliate_hits=[], single US geo host.
• maintenance_moderate store months_since_update=5; falls in 3-6mo band (+1.5).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Easy WhatsApp contact export [credential-theft] + malext.io malicious_extension_sentry; score 3.00 -> 5.50 (+2.5 cap 2.5).

Permissions Breakdown

• scripting medium Can inject JS into whatsapp.com; scoped to single host, reduces risk.
• storage low Local extension storage only, no cross-site reach.
• https://web.whatsapp.com/* medium Access to WhatsApp Web DOM including contacts and messages.

Pillar Scores

Bookkeeping