Is Comunidade ZDG FREE safe?
Comunidade ZDG FREE fetches and eval-executes a GitHub script inside WhatsApp Web after WhatsApp tabs load.
When a WhatsApp tab finishes loading, the service worker downloads wppconnect-wa.js from GitHub and executes it in the page's MAIN world, falling back to a bundled copy if the download fails. The extension also injects WABA and WaVoIP scripts into WhatsApp Web that store Meta/WABA auth and WaVoIP tokens in the page's localStorage, where other page scripts can read them.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itZDG - 2 other listings from the same operator, 1 of them carrying a finding
ZDG - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 628 users between them. 1 of them carries a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Comunidade ZDG FREE contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Comunidade ZDG FREE sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- raw.githubusercontent.comwidely used
Comunidade ZDG FREE sends data to raw.githubusercontent.com. A widely used service: 26 other extensions we have analysed send data here.