Is Contact Saver for WA - Export & Backup safe?
We analyzed Contact Saver for WA - Export & Backup version 1.4.0's actual code and gave it a 64/100 trust score. This is a useful but sensitive WhatsApp…
Bottom line
This is a useful but sensitive WhatsApp contact exporter with a page-message weakness and built-in analytics tracking.
What it can access
It can read detailed WhatsApp contact, group, label, and account-state data on WhatsApp, which fits contact export but is sensitive. [Q1][Q2][Q3]
Security weaknesses
Any code running in a WhatsApp page can request contact records through a message channel lacking origin and request checks. [Q21]
Signs of misuse
It sends account and product telemetry to its services and Google Analytics, but no contact upload, browsing tracking, or remote command behavior was found. [Q6][Q12][Q16][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has storage, scripting, and identity permissions, with page access restricted to WhatsApp domains.
Declares storage, scripting, and identity permissions plus host and content-script access only for *.whatsapp.com. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
It reads sensitive WhatsApp contact, chat, group, and label metadata when the popup is opened.
Enumerates WhatsApp ContactStore, ChatStore, GroupMetadataStore, and labels, collecting names, phone numbers, group membership, block status, and unread state. — injected.a4186a2d.js:1
The popup requests GET_ALL_CONTACTS automatically when it opens. — popup.100f6462.js:68
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It processes phone numbers, names, contact relationships, group membership, labels, and account-state metadata, but no message bodies were found in the export path.
Builds export records containing phone, formatted phone, saved/public names, group names, labels, business/contact status, block status, and unread state. — injected.a4186a2d.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores extension settings, trial state, and its own account session locally; it does not request browser history or cookie permissions.
Requests storage but not history, bookmarks, cookies, or browsingData. — manifest.json:3
The Google sign-in flow stores login state and a Supabase session for the extension's own account. — static/background/index.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It creates local contact-download files in CSV, spreadsheet, or vCard form; no device, microphone, camera, or clipboard access was found.
The export utility builds local Blob downloads for the selected contact format. — popup.100f6462.js:68
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends account and billing requests to its own Supabase and ExtBolt services, while the bundled WA-JS library sends product telemetry to Google Analytics. No contact-record upload was found.
Uses Supabase for extension authentication and worker-api.extbolt.com for subscription and project configuration. — popup.100f6462.js:20,68
WA-JS defaults Google Analytics on and emits authentication state, connection method, and product-version telemetry to analytics.google.com. — injected.a4186a2d.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It fetches subscription, project, and promotion settings from the vendor services, but those settings were not found controlling WhatsApp data collection or executable code.
Defines endpoints for subscription status, project configuration, review state, and promotions at worker-api.extbolt.com. — popup.100f6462.js:68
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The packaged WA-JS library is injected whenever WhatsApp loads, and contact enumeration begins automatically when the user opens the extension popup.
Registers the packaged injected script in the MAIN world for WhatsApp pages. — static/background/index.js:70
A popup useEffect invokes the contact request on mount. — popup.100f6462.js:68
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests none of the permissions used to control those browser settings. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package contains large minified third-party bundles, which reduce auditability but are not evidence of abuse by themselves.
Contains the minified WA-JS package and supporting libraries in a single generated line. — injected.a4186a2d.js:1
Contains a large generated popup bundle with application and dependency code. — popup.100f6462.js:1-72
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains eval("require")("stream") in a Node-oriented library helper and creates a script Blob from the packaged WA-JS string. — injected.a4186a2d.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Queries tabs only to find or open https://web.whatsapp.com for the advertised feature. — popup.100f6462.js:68
Does not request the history permission. — manifest.json:3
Does it create a persistent ID or browser fingerprint to recognize you?
The WA-JS dependency sends product and login-state telemetry to Google Analytics; no browsing-history or contact-record tracking was demonstrated.
The default WA-JS configuration enables Google Analytics and emits authentication state, connection method, powered-by value, and WhatsApp/WA-JS versions. — injected.a4186a2d.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Uses chrome.identity and Supabase OAuth to authenticate the user to the extension's own service. — static/background/index.js:1
Does not request the cookies permission. — manifest.json:3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares only storage, scripting, and identity permissions, with WhatsApp-only host access. — manifest.json:3
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote endpoints supply subscription and promotional configuration used by the extension UI. — popup.100f6462.js:68
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Registers injected.a4186a2d.js in the WhatsApp page's MAIN world. — static/background/index.js:70
Loads packaged WA-JS into a page script and uses its contact, chat, group, and label getters. — injected.a4186a2d.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It makes ordinary account, subscription, configuration, and analytics requests; no traffic interception, proxying, or arbitrary download was found.
Contacts Supabase and worker-api.extbolt.com for authentication and product configuration. — popup.100f6462.js:20,68
The bundled WA-JS tracker sends telemetry to analytics.google.com. — injected.a4186a2d.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does not request nativeMessaging or comparable system-level permissions. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches JSON configuration from worker-api.extbolt.com for billing and promotional UI. — popup.100f6462.js:68
The executable WA-JS string is packaged inside the extension rather than fetched from a remote server. — injected.a4186a2d.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
The WhatsApp page bridge accepts GET_ALL_CONTACTS from page messages without checking source, origin, or a nonce, then posts the assembled records back to the page.
A window message listener checks only data.action before reading records and replying through window.postMessage(..., "*"). — injected.a4186a2d.js:1
The isolated content script uses the same page-message channel and validates only that replies came from window. — contents.04ff201a.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Opening the popup requests contacts and the export controls create the chosen local file. — popup.100f6462.js:68
WA-JS initializes on WhatsApp pages and its default analytics hooks run during loader and authentication events. — injected.a4186a2d.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The active wrapper initializes WA-JS and responds to contact-export requests; no mining loop or mining endpoint was identified. — injected.a4186a2d.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The extension-specific page wrapper reads WhatsApp store models and does not alter form elements or submit destinations. — injected.a4186a2d.js:1