[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

DiscaZap

Version 0.4.3 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: discazap.com.br

Rating: 4.4 ★

Users: 5

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
unlimitedStorage
sidePanel
tabs
alarms
offscreen

Host Permissions:

https://web.whatsapp.com/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'

Embedded URLs (98 total):

https://rolldown.rs/in-depth/bundling-cjs#require-external-modules	https://web.dev/cross-origin-isolation-guide/
https://huggingface.co/	https://developer.mozilla.org/en-US/docs/Web/API/Cache
https://cdn.jsdelivr.net/npm/onnxruntime-web@	https://huggingface.co/docs/transformers/main/en/chat_templating
https://github.com/huggingface/transformers.js/issues/new/choose	https://huggingface.co/docs/transformers.js/guides/node-audio-processing.
https://gist.github.com/hollance/42e32852f24243b748ae6bc1f985b13a	https://github.com/supabase/supabase-js/blob/master/packages/core/realtime-js/migrations/httpsend-server-version.md
https://github.com/supabase/supabase-js/blob/master/packages/core/auth-js/migrations/lockless-coordination.md	https://github.com/orgs/supabase/discussions/45715
https://byqozdsrxengwcfbfvto.supabase.co	https://api.discazap.com.br
https://viacep.com.br/ws/	https://discazap.com.br/privacidade
https://wa.me/	https://react.dev/errors/
http://www.w3.org/2000/svg	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://xyzcompany.supabase.co	https://xyzcompany.supabase.co/functions/v1
https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API	https://postgrest.org/en/stable/api.html?highlight=options#errors-and-http-status-codes
https://xyzcompany.supabase.co/rest/v1/users	https://github.com/supabase/supabase-js/issues/92
https://docs.postgrest.org/en/stable/references/api/resource_representation.html#stripped-nulls	https://developer.mozilla.org/en-US/docs/Web/API/AbortController
https://geojson.org	https://supabase.com/docs/guides/database/debugging-performance#enabling-explain
https://postgrest.org/en/stable/api.html#operators	https://github.com/supabase/supabase/issues/5465
https://supabase.com/docs/reference/javascript/next/typescript-support	https://xyzcompany.supabase.co/rest/v1
https://www.postgresql.org/docs/current/functions-srf.html	https://github.com/supabase/supabase/issues/18
https://github.com/es-shims/es5-shim	https://developer.mozilla.org/en-US/docs/Web/API/CloseEvent#Status_codes
https://xyzcompany.supabase.co/realtime/v1	https://realtime.supabase.com/worker.js
https://github.com/sindresorhus/is-plain-obj	https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html
https://example.supabase.co/storage/v1/object/upload/sign/avatars/folder/cat.jpg?token=	https://example.supabase.co/storage/v1/object/sign/avatars/folder/avatar1.png?token=
https://example.supabase.co/storage/v1/object/sign/avatars/folder/avatar2.png?token=	https://example.supabase.co/storage/v1/object/public/public-bucket/folder/avatar1.png
https://supabase.com/dashboard	https://supabase.github.io/iceberg-js/
https://xyzcompany.supabase.co/storage/v1	https://github.com/supabase-community/base64url-js.
https://github.com/mike-north/types/blob/master/src/async.ts	https://xyzcompany.supabase.co/auth/v1
https://mathiasbynens.be/notes/globalthis	https://w3c.github.io/webauthn/#sctn-createCredential
https://w3c.github.io/webauthn/#sctn-getAssertion	https://w3c.github.io/webauthn/#sctn-automation-webdriver-capability
https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal	https://developer.mozilla.org/en-US/docs/Web/API/AbortController/abort
https://w3c.github.io/webauthn/#sctn-parseCreationOptionsFromJSON	https://w3c.github.io/webauthn/#sctn-parseRequestOptionsFromJSON
https://w3c.github.io/webauthn/#dom-publickeycredential-tojson	https://url.spec.whatwg.org/#valid-domain
https://www.oreilly.com/library/view/regular-expressions-cookbook/9781449327453/ch08s15.html	https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredential#browser_compatibility
https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/create	https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get
https://w3c.github.io/webauthn/#dictdef-authenticatorselectioncriteria	https://w3c.github.io/webauthn/#dictdef-publickeycredentialrequestoptions
https://w3c.github.io/webauthn/	https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
https://w3c.github.io/webauthn/#sctn-registering-a-new-credential	https://w3c.github.io/webauthn/#sctn-credential-creation
https://w3c.github.io/webauthn/#sctn-verifying-assertion	https://w3c.github.io/webauthn/#sctn-authentication
https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialRequestOptions	https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions
https://example.com/welcome	https://eips.ethereum.org/EIPS/eip-4361

Page 1 of 2

Raw Manifest

{
  "name": "DiscaZap",
  "icons": {
    "16": "icons/icon-16.png",
    "32": "icons/icon-32.png",
    "48": "icons/icon-48.png",
    "128": "icons/icon-128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon-16.png",
      "32": "icons/icon-32.png"
    },
    "default_title": "Abrir o DiscaZap"
  },
  "version": "0.4.3",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "short_name": "DiscaZap",
  "side_panel": {
    "default_path": "sidepanel.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Menos cliques. Mais conexões. Discador com fila, resultados e observações sobre o WhatsApp Web.",
  "permissions": [
    "storage",
    "unlimitedStorage",
    "sidePanel",
    "tabs",
    "alarms",
    "offscreen"
  ],
  "content_scripts": [
    {
      "js": [
        "bridge.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "https://web.whatsapp.com/*"
      ]
    },
    {
      "js": [
        "relay.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://web.whatsapp.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://web.whatsapp.com/*"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "116",
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://web.whatsapp.com/*"
      ],
      "resources": [
        "compact.html",
        "discazap-icon.svg"
      ]
    }
  ]
}

by ✦ Astarte

DiscaZap

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (98 total):

Raw Manifest

Detections

Manifest Findings