Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sellerwork [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• WhatsApp impersonation: brand_mention confirms is_impersonation=true for WhatsApp; developer not verified owner.
• Content script on WhatsApp Web can read/modify user messages with no broad host permission but still high-sensitivity context.
• Install URL hijack redirects to web.whatsapp.com on install — minor but signals dark-pattern awareness.
• No CSP declared (MV3 default applies, but js_external_hosts include reactjs.org — a CDN reference).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain grupoopt.com.br is not WhatsApp/Meta.
• install_url_hijack manifest install_url_hijack=true; target=https://web.whatsapp.com on install event.
• content_script_sensitive_site manifest Content script injected into https://web.whatsapp.com/* — reads/modifies chat UI.
• dom_sink_innerhtml crx innerHTML sink in vendor bundle without CSP; DOM-XSS risk if WhatsApp data flows through.
• no_csp manifest csp_present=false; MV3 default restricts eval but external host reactjs.org in js_external_hosts.
• privacy_policy_scope api Policy fetched, scoped to extension, data_collection+retention+third_party_sharing all true; adequate.
• low_install_count store Only 5 installs; no ratings; very limited trust signal.
• developer_domain_resolves api grupoopt.com.br resolves=true, looks_throwaway=false; no bad host or monetization hits.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sellerwork [data-theft] + malext.io malicious_extension_sentry; score 2.97 -> 5.47 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; no external data access.
• storage low Standard key-value local storage; minimal risk.
• tabs medium Can read tab URLs and titles; moderate info exposure.
• alarms low Scheduling only; no data access.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify page content including messages.

Pillar Scores

Bookkeeping