Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — BotPlugin [click-fraud] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy, not scoped to this extension — admits data collection and 3rd-party sharing.
• Content script on web.whatsapp.com can read user messages and conversation data.
• Unverified publisher with no verified-publisher badge; dev email on custom domain but not independently verified.
• Privacy policy domain mismatch (myaccount.google.com) signals no real disclosure for this extension.

Evidence

• privacy_policy_generic store Privacy policy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true — applies D rule (+10.0).
• whatsapp_content_script manifest content_scripts_matches includes https://web.whatsapp.com/* — script runs on a sensitive messaging platform.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; reputation starts at 5.0 with no discounts.
• developer_domain_resolves api multiweb.plus resolves, looks_throwaway=false, domain age 1524 days — established domain.
• cve_clear crx cve_findings_raw empty; no known vulnerable libraries detected.
• code_clean crx code_findings_raw empty, obfuscation_score=0.0; no malicious patterns found.
• csp_present_mv3 manifest CSP script-src 'self'; object-src 'self' — strict policy, MV3, no remote code loading.
• host_permissions_narrow manifest host_permissions limited to ws://localhost:3000/ only; no broad external host access.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — BotPlugin [click-fraud] + malext.io malicious_extension_sentry; score 2.28 -> 4.78 (+2.5 cap 2.5).

Permissions Breakdown

• ws://localhost:3000/ (host_permission) low Localhost WebSocket only; no external host access granted.
• http://localhost/* (content_script) low Scoped to localhost; minimal external exposure.
• https://app.botplugin.com.br/* (content_script) medium Content script on dev-controlled SaaS domain; can read/modify page content there.
• https://web.whatsapp.com/* (content_script) medium Content script on WhatsApp Web; can read messages and DOM on a sensitive messaging platform.

Pillar Scores

Bookkeeping