Is SLTD - Business Tools Sender safe?
SLTD sends your Chrome email, WhatsApp phone number and profile name to wa-web-plus.web.app on WhatsApp Web load.
When WhatsApp Web loads, the extension reads the logged-in WhatsApp number and profile name and sends them, with the Chrome profile's Google email, to the vendor's wa-web-plus.web.app server; no consent prompt is shown. Its per-chat webhook automation forwards message text, sender name, phone number and group name to an endpoint the user configures. HubSpot API keys entered in the CRM settings are sent to the vendor's relay as a URL query parameter.
Who publishes itSo Lets Talk Digital - 13 other listings from the same operator, none carrying a finding
So Lets Talk Digital - 13 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
13 other listings published from this account, 1k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WhatsApp Web Plus sends your Chrome email and WhatsApp number to its own server
Code analysis shows that on WhatsApp Web load, the extension sends your Chrome profile email, WhatsApp number and profile name to wa-web-plus.web.app, with no consent prompt in the code.
What actually happens
You open web.whatsapp.com while logged in to WhatsApp.
This runs once for each WhatsApp number that has not been recorded before.
The extension sends your Chrome profile email, WhatsApp number and name to wa-web-plus.web.app.
The code shows no consent prompt before the request.
Query parameters on the /auth-user request
- Chrome emailjane.doe@gmail.com (illustrative)
The Google account email signed in to your Chrome profile.
- WhatsApp number447700900123 (illustrative)
The phone number of the logged-in WhatsApp account.
- Profile nameJane Doe (illustrative)
The display name set on your WhatsApp profile.
- Extension version4.9.1.10
The installed extension version.
The code that does this
Page script and service worker code that build the request
Page script: first run per number only
app.jsconst me = WA.User.getMaybeMePnUser() || WA.User.getMaybeMeLidUser();if (!store.get('authed-' + me.user)) { const self = WA.Contact.where({ isMe: true }); window.dispatchEvent(new CustomEvent('authUser', { detail: { u: me.user, n: self[0]?.name || '' } })); store.set('authed-' + me.user, true);}Relay to the service worker
bundle.jswindow.addEventListener('authUser', (e) => { chrome.runtime.sendMessage({ type: 'authUser', obj: e.detail });});Service worker: look up Chrome profile email, then GET
worker.jsif (msg.type === 'authUser') { chrome.identity.getProfileUserInfo((info) => { fetch('https://wa-web-plus.web.app/auth-user?t=' + Math.random() + '&u=' + msg.obj.u + '&n=' + msg.obj.n + '&e=' + info.email + '&v=' + version); });}Hosts that receive identifiers
- wa-web-plus.web.app
Receives Chrome email, WhatsApp number and name at /auth-user and /triplo-user.
- app.soletstalkapp.com
Receives a user id at /stats/ispro from bundle.js; operator relationship not established.
Observation
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 4.9.1.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on web.whatsapp.com
*://web.whatsapp.com/*
Read and change your data on soletstalkapp.com
*://soletstalkapp.com/*
Read and change your data on web.app
*://*.web.app/*
Read and change your data on firebaseio.com
*://*.firebaseio.com/*
Read and change your data on firebaseapp.com
*://*.firebaseapp.com/*
Read and change your data on cloudfunctions.net
*://*.cloudfunctions.net/*
Read and change your data on zapier.com
*://*.zapier.com/*
Read and change your data on pabbly.com
*://*.pabbly.com/*
Read and change your data on integrately.com
*://*.integrately.com/*
Read and change your data on integromat.com
*://*.integromat.com/*
Read and change your data on apiway.ai
*://apiway.ai/*
Read and change your data on konnectzit.com
*://*.konnectzit.com/*
Read and change your data on knzt.it
*://*.knzt.it/*
Read and change your data on api.antsandapps.com
*://api.antsandapps.com/*
Read and change your data on res.cloudinary.com
*://res.cloudinary.com/*
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Sign you in with your Google account
identity
See the email address of your Google account
identity.email
Where it sends data
Destinations our analysis observed SLTD - Business Tools Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- wa-web-plus.web.app
SLTD - Business Tools Sender sends data to wa-web-plus.web.app. 6 other extensions we have analyzed send data here.
- app.soletstalkapp.com
SLTD - Business Tools Sender sends data to app.soletstalkapp.com. 5 other extensions we have analyzed send data here.
- User-configured webhook endpoints
SLTD - Business Tools Sender sends data to User-configured webhook endpoints. Named as a recipient in this extension's own analysis.