Is Nome de Atendente para WhatsApp safe?

High risk

Nome de Atendente para WhatsApp sends your WhatsApp account identifier to tbbc.app analytics from WhatsApp Web.

On WhatsApp Web, the extension reads identifiers from localStorage and adds the WhatsApp user id to analytics events sent to tbbc.app. It also sets Chrome's uninstall URL to a tbbc.app page that includes the installation/client id plus WhatsApp user id and phone number as query parameters.

Ofelquis Gimenesv1.0.3.6Chrome Web Store
75Risk
Who publishes it

Ofelquis Gimenes - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Ofelquis Gimenes
Website
tbbc.app/posts/nome-do-atendente-whatsapp

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp add-on sends your WhatsApp ID to a third-party analytics server

The extension reads your WhatsApp account ID from the page and sends it to tbbc.app analytics with a persistent install ID on every usage event.

We confirmed this by planting a test ID and watching it appear in the outgoing request.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open WhatsApp Web with the extension installed and use the chat interface.

The extension did this

The extension reads your WhatsApp account ID from the page and sends it to a third-party analytics server along with a persistent installation ID.

This happens automatically on usage events, with no consent prompt.

Fields sent in each analytics event
  • WhatsApp account ID
    5511987654321

    The numeric ID tied to your WhatsApp account, extracted from data WhatsApp itself stores in the page.

  • Installation ID
    ad1589e2-3740-4a9a-9e15-2415e99b9272

    A random ID generated once per install, sent with every event to tie it back to this browser.

  • Event name
    extension_initialized_with_username

    Identifies which action inside the extension triggered the analytics call.

Captured request
POSThttps://tbbc.app/analytics/send
Headers
X-Client-Id
ad1589e2-3740-4a9a-9e15-2415e99b9272
Content-Type
application/json
Body
{  "eventName": "extension_initialized_with_username",  "props": {},  "userProps": {    "user_id": "ad1589e2-3740-4a9a-9e15-2415e99b9272",    "extension_version": "1.0.3.6",    "whatsapp_user_id": "5511987654321"  },  "timestamp_micros": 1757355321000000,  "non_personalized_ads": true}
Where the data goes
    • tbbc.app

    Analytics collection endpoint that receives the WhatsApp account ID and a persistent per-install client ID from the extension.

WhatsApp identifiers are added to the uninstall URL.

Nome de Atendente para WhatsApp reads WhatsApp identifiers from browser storage on Web WhatsApp and adds the user ID and phone number to a tbbc.app uninstall URL, so those values are sent if you uninstall the extension.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user uses Web WhatsApp and later uninstalls the extension.

The extension did this

The extension reads Web WhatsApp storage identifiers and includes them in the uninstall URL.

Captured request
GEThttps://tbbc.app/posts/desinstalado-com-sucesso-nome-de-atendente-whatsapp
Fields in the uninstall URL
  • Web WhatsApp storage data
    5511999999999 (illustrative)

    Browser storage values are used to derive the WhatsApp user ID and phone number sent with the uninstall URL.

What it can do

Permissions this extension asks for, as declared in version 1.0.3.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Nome de Atendente para WhatsApp contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • tbbc.app

    Nome de Atendente para WhatsApp sends data to tbbc.app. No other extension we have analysed sends data here.

Updated 30 September 2026nakomaepnfdjnbackfamckemcpphfcem