Top Risks

• WhatsApp brand impersonation by unverified gmail developer with no stated org identity.
• Extension stale for 26 months — zombie risk for compromise or abandonment.
• Privacy policy is non-scoped (scope_extension=false, data_collection=false) on free GitHub hosting — inadequate.
• Uninstall URL hijack detected — likely redirects to 3rd-party on uninstall.
• No CSP on MV3 extension with DOM innerHTML sink in content-script on WhatsApp Web.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is gmail user with no confirmed ownership.
• uninstall_url_hijack crx uninstall_url_hijack=true; 3rd-party redirect on uninstall is a monetization/tracking signal.
• stale_extension store Last updated April 2024; months_since_update=26, exceeds 24-month high-risk threshold.
• privacy_policy_inadequate api Policy fetched but scope_extension=false, hosted on free GitHub Pages, length=441 chars.
• dom_sink_innerhtml crx innerHTML used in content-script.js without CSP; potential DOM-XSS on WhatsApp Web DOM.
• external_hosts crx js_external_hosts includes fb.me, survey.typeform.com, tally.so — 3 distinct 3rd-party domains.
• free_webmail_dev_no_org store developer_email=labssingularity@gmail.com; developer_name empty; no verified business entity.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; partially offsets reputation concerns.

Permissions Breakdown

• storage low Stores extension settings locally; no cross-site data exposure.
• host_permission: https://*.web.whatsapp.com/ medium Scoped to WhatsApp Web only; matches stated function but grants DOM access to chat data.

Pillar Scores

Bookkeeping