Is WAPI FREE - Jaguar safe?

Low risk

WAPI FREE - Jaguar sends WhatsApp Web page details and engagement events to Google Analytics.

When loaded on WhatsApp Web, the extension injects a WA-JS bundle that initializes Google Analytics and records user_engagement, login, and logout events. Those beacons include a persistent client ID plus page URL, title, referrer, language, and screen details; the panel also requests banner configuration from api.serverwapi.com on page load.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

creativoslatv3.2.307Chrome Web Store
20Risk
Who publishes it

creativoslat - 2 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
creativoslat

Same store account

2 other listings published from this account, 16k+ users between them. 1 of them carries a finding.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.serverwapi.com
Also called by 1 other listing: Wapi IA - Asistente para Mensajes
wapi7.com
Also called by 1 other listing: Wapi IA - Asistente para Mensajes

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.2.307. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on web.whatsapp.com

    http://web.whatsapp.com/* and 1 more

  • Read and change your data on script.google.com

    https://script.google.com/*

  • Read and change your data on script.googleusercontent.com

    https://script.googleusercontent.com/*

  • Read and change your data on i.imgur.com

    https://i.imgur.com/*

  • Read and change your data on imgur.com

    https://imgur.com/* and 1 more

  • Read and change your data on wapi7.com

    https://wapi7.com/*

  • Read and change your data on www.wapi7.com

    https://www.wapi7.com/*

  • Run its own code inside the pages you visit

    scripting

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Clear your browsing history, cache and cookies

    browsingData

  • Keep running in the background while your browser is open

    background

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed WAPI contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • analytics.google.comwidely used

    WAPI sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.

  • api.serverwapi.com

    WAPI sends data to api.serverwapi.com. One other extension we have analysed sends data here.

Updated 30 September 2026cgnhpniejimbnmgiccckgiaejdgbeebb