Is Group Contact Extractor for WA safe?
Group Contact Extractor for WA reads the user's WhatsApp phone number and sends it to an Alibaba Cloud logging service.
When the extension loads on WhatsApp Web, it reads the user's phone number from localStorage and assigns a persistent UUID. This data, along with behavioral telemetry such as popup interactions and export counts, is transmitted to an Alibaba Cloud (Aliyun) logging endpoint on each session and user action.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WhatsApp export activity and a persistent device ID sent to Alibaba Cloud
Group Contact Extractor for WA logs usage to Alibaba Cloud.
Opening the popup sends an 'openPopup' event with a persistent device ID and install time; each export sends the record count and your WhatsApp number if stored.
You open the extension popup while on WhatsApp Web.
Opening the popup is a normal step before extracting or exporting contacts.
The extension sends a behavioral event to an Alibaba Cloud logging endpoint.
The event carries a persistent device ID, the install timestamp, an export-count field, and your WhatsApp number if it was previously stored.
{
"__logs__": [
{
"extensionName": "hGroup",
"version": "2.0.8",
"firstVersion": "2.0.8",
"platform": "extension",
"uuid": "ZNWCzpu1xgHh",
"installTimestamp": "1781526675615",
"event": "openPopup",
"eventDetail": "",
"phone": "",
"isBusiness": "n",
"email": "",
"exportNums": 0
}
]
}| Field | Value | Why it matters | |
|---|---|---|---|
Persistent device ID | ZNWCzpu1xgHh | A random ID generated once per install and reused on every event, letting the operator link all of an install's activity over time. | |
Your WhatsApp number | 447700900123 | Included only if your number was previously read into the extension's storage. Empty otherwise. | |
Install timestamp | 1781526675615 | When the extension was first installed, used as a stable per-install marker. | |
Export count | 342 | On export events, the number of contacts, chats, groups, or labels exported in that action. | |
Event name | exportContact | Which interaction occurred: openPopup, exportContact, exportChat, exportGroup, or exportLable. | |
Business flag | n | Whether the extension detected a WhatsApp Business account. |
Popup reads stored number, then routes events through the background worker to Aliyun
chrome.storage.local.get(["userNumber", "businessFlag"], (stored) => {
const eventObj = { event: "openPopup" };
const updateParams = {};
if (stored.userNumber) updateParams.phone = stored.userNumber;
if (stored.businessFlag) updateParams.isBusiness = "y";
chrome.runtime.sendMessage({ action: "log", eventObj, updateParams });
});this.downloadCSV("Contacts", this.contactsInfoTwoPop);
chrome.runtime.sendMessage({
action: "log",
eventObj: { event: "exportContact", eventDetail: "csv", exportNums: this.contactsInfoTwoPop.length },
updateParams: {}
});chrome.runtime.onMessage.addListener((msg) => {
if (msg.action !== "log") return;
// updateParams (e.g. phone) become sticky fixed params
if (Object.keys(msg.updateParams).length) Object.assign(fixedParams, msg.updateParams);
if (Object.keys(msg.eventObj).length)
tracker.sendEvent({ ...fixedParams, ...msg.eventObj });
});function sendBeacon(url, body) {
return !!(navigator && navigator.sendBeacon) && navigator.sendBeacon(url + "?APIVersion=0.6.0", body);
}
function sendFetch(url, body) {
fetch(url + "?APIVersion=0.6.0", { method: "POST", body }).catch(() => {});
}- extensionow-log.ap-southeast-1.log.aliyuncs.com
Alibaba Cloud (Aliyun) Log Service, Singapore region. Receives behavioral events, the device ID, install time, export counts, and the WhatsApp number when present.