Is Group Contact Extractor for WA safe?

Medium risk

Group Contact Extractor for WA reads the user's WhatsApp phone number and sends it to an Alibaba Cloud logging service.

When the extension loads on WhatsApp Web, it reads the user's phone number from localStorage and assigns a persistent UUID. This data, along with behavioral telemetry such as popup interactions and export counts, is transmitted to an Alibaba Cloud (Aliyun) logging endpoint on each session and user action.

hb623999v2.0.9Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

WhatsApp export activity and a persistent device ID sent to Alibaba Cloud

Group Contact Extractor for WA logs usage to Alibaba Cloud.

Opening the popup sends an 'openPopup' event with a persistent device ID and install time; each export sends the record count and your WhatsApp number if stored.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the extension popup while on WhatsApp Web.

Opening the popup is a normal step before extracting or exporting contacts.

The extension did this

The extension sends a behavioral event to an Alibaba Cloud logging endpoint.

The event carries a persistent device ID, the install timestamp, an export-count field, and your WhatsApp number if it was previously stored.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://extensionow-log.ap-southeast-1.log.aliyuncs.com/logstores/h-group/track?APIVersion=0.6.0
Captured during dynamic analysis: opening the popup produced this POST to the Alibaba Cloud (Aliyun) Simple Log Service endpoint, carrying a persistent uuid and install timestamp.
Body
{
  "__logs__": [
    {
      "extensionName": "hGroup",
      "version": "2.0.8",
      "firstVersion": "2.0.8",
      "platform": "extension",
      "uuid": "ZNWCzpu1xgHh",
      "installTimestamp": "1781526675615",
      "event": "openPopup",
      "eventDetail": "",
      "phone": "",
      "isBusiness": "n",
      "email": "",
      "exportNums": 0
    }
  ]
}
03EvidenceFIELD TABLE
Fields carried in each tracking event
FieldValueWhy it matters
Persistent device ID
ZNWCzpu1xgHhA random ID generated once per install and reused on every event, letting the operator link all of an install's activity over time.
Your WhatsApp number
447700900123Included only if your number was previously read into the extension's storage. Empty otherwise.
Install timestamp
1781526675615When the extension was first installed, used as a stable per-install marker.
Export count
342On export events, the number of contacts, chats, groups, or labels exported in that action.
Event name
exportContactWhich interaction occurred: openPopup, exportContact, exportChat, exportGroup, or exportLable.
Business flag
nWhether the extension detected a WhatsApp Business account.
04EvidenceCODE COMPARE
The code that does this

Popup reads stored number, then routes events through the background worker to Aliyun

What it actually does
On popup open: read stored number + business flag, send openPopup eventpopup.js
chrome.storage.local.get(["userNumber", "businessFlag"], (stored) => {
  const eventObj = { event: "openPopup" };
  const updateParams = {};
  if (stored.userNumber)   updateParams.phone = stored.userNumber;
  if (stored.businessFlag) updateParams.isBusiness = "y";
  chrome.runtime.sendMessage({ action: "log", eventObj, updateParams });
});
On export: send event tagged with the number of records exportedpopup.js
this.downloadCSV("Contacts", this.contactsInfoTwoPop);
chrome.runtime.sendMessage({
  action: "log",
  eventObj: { event: "exportContact", eventDetail: "csv", exportNums: this.contactsInfoTwoPop.length },
  updateParams: {}
});
Background worker merges fixed params (uuid, phone, installTimestamp) with each event and sends itbackground.js
chrome.runtime.onMessage.addListener((msg) => {
  if (msg.action !== "log") return;
  // updateParams (e.g. phone) become sticky fixed params
  if (Object.keys(msg.updateParams).length) Object.assign(fixedParams, msg.updateParams);
  if (Object.keys(msg.eventObj).length)
    tracker.sendEvent({ ...fixedParams, ...msg.eventObj });
});
Transport: sendBeacon to the Aliyun log endpoint, fetch POST as fallbackbackground.js
function sendBeacon(url, body) {
  return !!(navigator && navigator.sendBeacon) && navigator.sendBeacon(url + "?APIVersion=0.6.0", body);
}
function sendFetch(url, body) {
  fetch(url + "?APIVersion=0.6.0", { method: "POST", body }).catch(() => {});
}
05EvidenceTHIRD PARTY LIST
Where the telemetry is sent
  • extensionow-log.ap-southeast-1.log.aliyuncs.com

    Alibaba Cloud (Aliyun) Log Service, Singapore region. Receives behavioral events, the device ID, install time, export counts, and the WhatsApp number when present.

Data recipients

extensionow-log.ap-southeast-1.log.aliyuncs.com
Updated 17 September 2026hboaocjifmkibpeajkgaliiaaiodikon