Top Risks

• Operator cluster of 9 sibling extensions under same dev email — mass deployment pattern with WhatsApp access.
• Uninstall URL hijack and install URL hijack both set — traffic manipulation on install/uninstall.
• Privacy policy is Google's generic policy (not scoped to this extension) admitting data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer (extensao.store) — not a confirmed Meta partner.
• 11 external JS hosts (wascript.com.br, watools.com.br) contacted from WhatsApp Web context — broad exfil surface.

Evidence

• operator_cluster_siblings api 9 sibling extensions share same dev email, install URL, and JS host fingerprint — coordinated deployment cluster.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install_url_hijack also true — traffic hijack on lifecycle events.
• brand_impersonation store WhatsApp brand mentioned; developer extensao.store is not confirmed Meta owner — is_impersonation=true.
• generic_privacy_policy api Policy URL is myaccount.google.com/privacypolicy — not scoped to ZappyGO; data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10+ external hosts under wascript.com.br/watools.com.br contacted from WhatsApp Web content script context.
• function_constructor crx new Function() found in bundled JS — dynamic code execution risk, +2.5 code quality.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script with no CSP — DOM-XSS sink elevated by missing CSP.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit CSP); amplifies code findings.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; moderate concern for CRM data hoarding.
• storage low Standard key-value storage; low risk alone.
• alarms low Scheduled background tasks; low risk.
• tabs medium Can read tab URLs and metadata across browser; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; reads/manipulates all WhatsApp DOM and data.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping