Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — WaUp [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL is Google's generic policy (fetch error); no extension-specific data disclosure exists.
• Free-webmail Gmail developer with no verified business identity; unaccountable if extension is sold.
• eval() in bundled audio encoder libs with no CSP; remote-code-execution surface if libs are compromised.
• External JS host 'discoveric.ru' (Russia-geolocated) alongside 3 distinct country origins raises supply-chain concern.

Evidence

• free_webmail_developer store Developer email hebrainmartins@gmail.com — free webmail, no verified business domain.
• privacy_policy_fetch_failed api Privacy policy URL points to Google's generic policy; fetch returned SSLError — no extension-scoped policy.
• eval_in_bundled_libs crx eval() found in Mp3LameEncoder.min.js and OggVorbisEncoder.min.js; no CSP to mitigate.
• function_constructor crx new Function() in sweetalert2.js can execute arbitrary strings; no CSP present.
• suspicious_external_host crx JS contacts discoveric.ru (RU-geolocated); unrecognized host for a WhatsApp productivity tool.
• third_party_backend manifest host_permission for app.prontei.com/api/* — data from WhatsApp DOM could be sent to unknown backend.
• no_csp manifest content_security_policy is null; eval and Function() findings have no mitigating CSP barrier.
• geo_diversity api JS hosts span 3 countries (CA, RU, US); Russian-hosted endpoint is anomalous for this category.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — WaUp [data-theft] + malext.io malicious_extension_sentry; score 4.47 -> 6.97 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local data persistence; low harm potential alone.
• unlimitedStorage low Extends storage quota; no direct data-exfil risk.
• activeTab low Scoped to user-activated tab; limited reach.
• host: https://web.whatsapp.com/* medium Content script on WhatsApp; can read messages and DOM.
• host: https://app.prontei.com/api/* medium Allows XHR to third-party backend; data could be sent there.

Pillar Scores

Bookkeeping