Is POUPE TEMPO SIMPLES ZAP safe?

Medium risk

POUPE TEMPO SIMPLES ZAP loads a fingerprinting script from openfpcdn.io into WhatsApp Web pages.

On WhatsApp Web, the extension injects a script into the page that imports FingerprintJS from the third-party CDN openfpcdn.io at runtime, without pinning or integrity checks, to compute a visitor ID. The imported code runs in the page context with access to the WhatsApp DOM. The extension also removes the page's Content-Security-Policy header through declarativeNetRequest rules, which lets this import work.

v2.1.7Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp Web page imports a fingerprinting module from a third-party CDN

Code analysis shows a script injected into WhatsApp Web imports unpinned code from openfpcdn.io on each load, with the page's CSP header cleared by the extension.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open web.whatsapp.com.

The content script matches *://*.whatsapp.com/*.

The extension did this

A script from the extension is inserted into the page, and it imports code from a third-party CDN.

The imported module runs with the same access as WhatsApp's own scripts.

The code that does this

Injection and remote import

Readable version

Script injected into the page

smph/app.js
loadScripts(["/js/jquery.js", "/js/siema.min.js?cache=" + Date.now(), "/smph/smphE.js", "/js/FingerPrint.js", "/js/wppconnect-wa.js"]);

Remote module import

js/FingerPrint.js
const fpPromise = import('https://openfpcdn.io/fingerprintjs/v3')            .then(FingerprintJS => FingerprintJS.load())                  // Get the visitor identifier when you need it.          fpPromise            .then(fp => fp.get())            .then(result => {              // This is the visitor identifier:              uid = result.visitorId            })
The code that does this

Rule that clears the page's Content-Security-Policy

Readable version
background.js
addRules.push({        id,        action: {          type: 'modifyHeaders',          responseHeaders: [{ header: 'content-security-policy', operation: 'set', value: '' }]        },        condition: {urlFilter: url, resourceTypes: ['main_frame', 'sub_frame']}      })
What the code shows
  • Import source
    https://openfpcdn.io/fingerprintjs/v3

    Code is fetched from a third party, not shipped in the extension.

  • Version pinning
    none, no integrity hash

    The served code can change without an extension update.

  • Visitor ID
    uid = result.visitorId

    A device identifier is computed and kept in a page global.

  • Page scope
    *://*.whatsapp.com/*

    The code runs in the WhatsApp Web page context.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed POUPE TEMPO SIMPLES ZAP contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • openfpcdn.io

    POUPE TEMPO SIMPLES ZAP sends data to openfpcdn.io. 2 other extensions we have analysed send data here.

Updated 15 October 2026nkbcolbfngcdndnbpbilmlbcbgakhjbn