Is WA Bulk Message Sender - WAMessager safe?
WAMessager is high risk. Opening the WAMessager popup on WhatsApp Web makes the extension read your Chrome profile email and ask the content script for the active account number, then POST both as JSON to wamessager-backend.onrender.com/api/user/createUser.…
Who publishes itwamessager - no other listings under this identity, 2 shared hostnames
wamessager - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Google email and WhatsApp number sent on popup open
Opening the WAMessager popup on WhatsApp Web makes the extension read your Chrome profile email and ask the content script for the active account number, then POST both as JSON to wamessager-backend.onrender.com/api/user/createUser.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension popup while WhatsApp Web is the active site.
The popup initialization runs after it finds or opens a WhatsApp Web tab.
The extension combines your Chrome profile email with your WhatsApp account number and prepares a backend request.
The code path is in the popup startup handler and the WhatsApp content-script message receiver.
- Chrome profile emailalex.morgan@gmail.com (illustrative)
Links the request to the Google account signed into the browser profile.
- WhatsApp account number+14155552671 (illustrative)
Links the same request to the WhatsApp account open in the tab.
- Content-Type
- application/json
Complete shipped functions behind the popup-to-backend flow
Readable flow equivalent
js/popup.js and content.jsasync function initializePopup() { const [activeTab] = await chrome.tabs.query({ active: true, currentWindow: true }); chrome.tabs.sendMessage(activeTab.id, { greeting: "hello" }, async (reply) => { if (!reply || reply.number == null) return; const phoneNumber = reply.number; chrome.identity.getProfileUserInfo(async (profile) => { if (!profile || !profile.id) return; const email = profile.email; await createUser(email, phoneNumber); }); });}async function createUser(email, phoneNumber) { const headers = new Headers(); headers.append("Content-Type", "application/json"); const body = JSON.stringify({ email, phoneNumber }); return fetch("https://wamessager-backend.onrender.com/api/user/createUser", { method: "POST", headers, body, redirect: "follow" });}function getWhatsAppNumberFromPageStorage() { if (window.localStorage.getItem("last-wid")) { return window.localStorage.getItem("last-wid").split("@")[0].substring(1); } return window.localStorage.getItem("last-wid-md").split(":")[0].substring(1);}- wamessager-backend.onrender.com
Receives the createUser POST containing the Chrome profile email and WhatsApp account number; hosted on Render.
WhatsApp phone number reported after bulk sends
After a bulk WhatsApp send session, WAMessager reads the WhatsApp account identifier from the page's local storage, counts messages sent, and posts that phone number plus the send count to wamessager-backend.onrender.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You complete a bulk WhatsApp send session through the extension.
The code path only reaches the backend update when the send loop records at least one sent message.
The extension sends your WhatsApp phone number and the session's sent-message count to its backend.
The phone number is derived from WhatsApp local storage before the send session runs.
- Your WhatsApp phone number15551234567 (illustrative)
Identifies the WhatsApp account used for the bulk send session.
- Messages sent in the session42 (illustrative)
Shows how many messages the extension recorded as sent during that run.
- Content-Type
- application/json
The storage read and post-send backend update in shipped code
Readable page-load identifier extraction
content.jswindow.onload = function () { try { if (window.localStorage.getItem("last-wid")) { var a = window.localStorage.getItem("last-wid"); myNumber = a.split("@")[0].substring(1); } else ((a = window.localStorage.getItem("last-wid-md")), (myNumber = a.split(":")[0].substring(1))); chrome.storage.local.set({ currentState }); } catch (b) {}};Readable send loop and backend update
content.jsasync function core_sending(a, b, c, e, d, q, m, p, h, k, l) { let g = 0; currentState = (await chrome.storage.local.get("currentState")).currentState; for (let f = 0; f < a.length; f++) { a[f] = a[f].toString().replace(/\D/g, "").replace(/^0+/, ""); currentState = { ...currentState, msgCount: f, msgSent: g, msgTotal: m }; await chrome.storage.local.set({ currentState }, () => { chrome.runtime.sendMessage({ subject: "progress-bar-sent", from: "content", count: f, sent: g, total: m, }); }); pauseSending && ((currentState = { ...currentState, state: "PAUSE" }), await chrome.storage.local.set({ currentState }), await pauser()); if (stopSending) { stopSending = !1; break; } if (a[f] != "") { var n = null; f != 0 && ((n = parseInt(d) + Math.floor(Math.random() * (q - d))), await sleep(n * 1e3)); l && f != 0 && f % parseInt(h) == 0 ? await sleep(parseInt(k) * 1e3) : f != 0 && f % 10 == 0 && (await sleep(1e4)); n = !1; try { a[f].length > 4 && a[f].length < 21 && (n = await openChat(a[f])); } catch (v) { n = !1; } if (n) { var t = isUnsubscribed(); if (t) rows.push([a[f], "User has unsubscribed"]); else { b[f] = b[f].trim(); if ( n && !t && b[f] != "" && (document.querySelectorAll("[contenteditable='true']")[1] || document.querySelectorAll("[contenteditable='true']")[0]) ) try { (p && (b[f] += "\n\nSent at: " + new Date().toISOString()), await sendText(b[f], a[f], 0), rows.push([a[f], "Message sent"]), g++); } catch (v) { console.log("error while sending to: ", a[f], v); rows.push([a[f], "Some Error Please Try This Number Again"]); continue; } if (e) { // let v; try { let r = await chrome.storage.local.get("attachment_data"); // v = (await WAM.chat.getActiveChat()).id.user; if ((r = r?.attachment_data)) for (let w = 0; w < r.length; w++) { await sleep(1e3); if (c) { let u = r[w].fileCaption; for (const [B, z] of Object.entries(c[0])) u = u.replaceAll("{{" + z + "}}", "{{" + B + "}}"); var x = u.match(coloumn_pattern), A = u.match(replace_pattern); n = u; if (x != null && A != null) for (t = 0; t < x.length; t++) n = n.replace(A[t], c[f + 1][x[t]] || ""); r[w].fileCaption = n; } await new Promise((u) => { window.addEventListener( "wam:attachments-sent", function C(z) { removeEventListener("wam:attachments-sent", C); u(); }, ); window.postMessage({ type: "FROM_CONTENT_SCRIPT", message: { request: "sendAttachment", attachment: r[w], // number: v, }, }); }); } let y = rows[rows.length - 1]; y && y[0] == a[f] ? (rows[rows.length - 1][1] = y[1] + " & Media Sent") : rows.push([a[f], "Media sent"]); } catch (r) { console.log("ERROR in sending media to: ", a[f], r); } } } } else rows.push([a[f], "Invalid number"]); } } currentState = { ...currentState, state: "STOP" }; await chrome.storage.local.set({ currentState }, () => { chrome.runtime.sendMessage({ subject: "progress-bar-sent", from: "content", count: m, sent: g, total: m, }); export_results(); }); g > 0 && ((a = { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ phoneNumber: myNumber, messagesSent: g }), }), fetch(`${url}/api/user/updateUsedMessages`, a).then().catch(), (a = (await chrome.storage.local.get("DAILY_MSG_LEFT")).DAILY_MSG_LEFT), chrome.storage.local.set({ DAILY_MSG_LEFT: a - g }));}- wamessager-backend.onrender.com
Receives the post-send update containing the WhatsApp phone number and the messages-sent count.