Is B Tools safe?

class UniversalUserPropertiesService {
  // The DI-injected argument is accepted but never used
  createLead() {
    const self = this;
    return (async function* () {
      // NOTE: 'alternatePhone' below is actually the logged-in WhatsApp
      // account's own phone number (extAuth.currentUser), not a second
      // number the user entered.
      const waAccountPhoneNumber = self.extAuth.currentUser.phoneNumber;
      const waAccountName = self.extAuth.currentUser.name;
      const signupEmail = self.extAuth.getUserDetails()?.email;
      const signupCountryInfo = self.extAuth.getUserDetails()?.countryInfo;
      const signupPhoneNumber = self.extAuth.getUserDetails()?.number;

      return self.leadService.createLead({
        name: waAccountName,
        phoneNumber: signupPhoneNumber,
        email: signupEmail,
        countryInfo: signupCountryInfo,
        alternatePhone: waAccountPhoneNumber,
      });
    })();
  }
}

const JOYZ_ENTERPRISE_ID = "67585858ed44a90bb3662ee1";

class JoyzLeadService {
  async createLead(lead) {
    const fields = [
      { fieldId: "contact_name", type: "TEXT", valueText: lead.name },
      {
        fieldId: "contact_phone",
        type: "PHONE",
        valuePhone: {
          countryInfo: lead.countryInfo || {
            name: "India",
            code: "IN",
            dial_code: "91",
          },
          phoneNumber: lead.phoneNumber,
        },
      },
      { fieldId: "contact_status", type: "DROPDOWN", valueDropdown: "New lead" },
      { fieldId: "contact_source", type: "DROPDOWN", valueDropdown: "WACA" },
    ];

    if (lead.email) {
      fields.push({ fieldId: "contact_email", type: "EMAIL", valueEmail: lead.email });
    }
    if (lead.alternatePhone) {
      fields.push({ fieldId: "1_TEXT", type: "TEXT", valueText: lead.alternatePhone });
    }

    const entity = {
      id: "",
      eId: JOYZ_ENTERPRISE_ID,
      entityType: "CONTACT",
      fields,
      parentEntityId: "",
      parentEntityType: null,
      activities: [],
      createdBy: "",
      lastSeenTimestamp: 0,
      creationTimestamp: Date.now(),
      modificationTimestamp: Date.now(),
    };

    try {
      const res = await fetch(
        `https://6vokqgdnu4.execute-api.ap-south-1.amazonaws.com/enterprise/${JOYZ_ENTERPRISE_ID}/entities`,
        {
          method: "POST",
          headers: {
            "Content-Type": "application/json",
            // Hardcoded admin-scoped credential, identical for every install
            Authorization: "<redacted>",
          },
          body: JSON.stringify({ entity }),
        },
      );
      if (!res.ok) {
        const err = await res.json();
        throw new Error(`HTTP ${res.status}: ${err.message || "Unknown error"}`);
      }
      return await res.json();
    } catch (err) {
      console.error("Error creating contact:", err);
    }
  }
}

// Hardcoded TeleCRM lead-intake endpoint, same enterprise ID for every install
const TELECRM_ROOT_URL = "https://us-central1-waplugin-34798.cloudfunctions.net",
  TELECRM_LEAD_ROUTE =
    "https://next-api.telecrm.in/enterprise/60a51c74589084cee99c1903/autoupdatelead",

class BackgroundApi {
  static createLead(leadPayload) {
    const self = this;
    return (async function* () {
      return self.httpPost(`${TELECRM_LEAD_ROUTE}`, leadPayload, {
        // Hardcoded bearer token, identical for every install
        Authorization: "Bearer <redacted>",
      });
    })();
  }
}

case Messages.API_CREATE_LEAD:
  return (
    BackgroundApi
      .createLead(message.data.properties)
      .then((result) => sendResponse(result))
      .catch((err) => {
        console.error("Error in API_CREATE_LEAD:", err);
        sendResponse(null);
      }),
    true
  );