Is Free Mass Message Bulk sender safe?
Free Mass Message Bulk sender is medium risk. Sending a single or bulk WhatsApp message through the extension posts the message text and recipient phone numbers to metjetsac.com, along with a stored user identifier tying that send to the extension's telemetry endpoint.
Who publishes itescuderohuillcamasccoevaristo - 3 other listings from the same operator, 1 of them carrying a finding
escuderohuillcamasccoevaristo - 3 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 19k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WhatsApp bulk sends post message text and phone numbers to metjetsac.com.
Sending a single or bulk WhatsApp message through the extension posts the message text and recipient phone numbers to metjetsac.com, along with a stored user identifier tying that send to the extension's telemetry endpoint.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
A user starts a single-recipient or bulk WhatsApp Web send through the extension.
The extension posts the message text, recipient phone numbers, and stored user identifier to its bulk-message statistics endpoint.
- Message and recipient entriesMessage: Hello team (illustrative); phoneNumbers: +15551234567 (illustrative)
The form input identifies what WhatsApp message is being sent and which phone numbers are targeted.
- Stored user identifieruser-12345 (illustrative)
The stored value links the request to an extension user account or installation record.