Is WA-Sender safe?

Question

Is WA-Sender safe?

Accepted Answer

WA-Sender is high risk. When the bundled SweetAlert2 file runs on a Russian-language browser and a .ru, .su, .by, or xn--p1ai page, it stores an initiation time and, after more than 3 days, disables pointer interaction and appends a looping audio element. The code points the audio element at https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3; the proof-of-concept confirmed the time condition with a 4-day-old stored initiation value and did not record personal data fields being sent. When you use WA-Sender with WhatsApp Web, the extension automatically contacts command.loboware.com for authentication, alerts, and configuration. The reviewed rows describe storage-related data and remote configuration being exchanged with an infrastructure domain that was not disclosed in the listing or privacy policy.

Is WA-Sender safe?

Findings