Is Rocket Sender - Bulk WhatsApp Messages & Automation safe?

Question

Accepted Answer

Rocket Sender - Bulk WhatsApp Messages & Automation is medium risk. Rocket Sender's content script is registered to run on every website you visit (the manifest's match pattern is <all_urls>). On each page it loads, the script reads a list of CSS class names that the extension downloads from the developer's server (cdn2.waplus.io) and refreshes every five minutes. If the current page's HTML contains any class from that list, the extension injects its privileged automation bundle (inject.js) and starts its WhatsApp automation routines. During dynamic analysis the automation only activated on web.whatsapp.com, because today's remote list only matches WhatsApp Web's markup; navigating to example.com and Wikipedia did not trigger injection. The point of this finding is that the gate deciding where the heavy automation runs lives in remote configuration the developer can change at any time, not in the extension's published manifest, so the targeting can be retargeted without an extension update or store review.

Is Rocket Sender - Bulk WhatsApp Messages & Automation safe?

Findings