MalExt Sentry ← Report Library 2026-06-27 data-collection voice-transmission csp-modification whatsapp white-label CRMware: 50-Extension WhatsApp CRM Platform (coderlicences[.]com) Extension list : https://malext.io/?q=WhatsCluster Platform Indicators Field Value Platform coderlicences[.]com (Brazil), internal name "wadi" Network size 50 Chrome extensions Total installs ~15,579 Version analyzed 2.10.0 Shared EXTENSION_API_KEY sSpKEML64a2X855FkIpGAdv4VLM72kgjgR0DyT9zGqK7Om6FPPGi2VsAaRCqx9Gw Backend API hxxps://api[.]coderlicences[.]com/api/v1 Event channel hxxps://api[.]coderlicences[.]com/api/v1/license/auth/events Operator portal hxxps://app[.]coderlicences[.]com Voice transcription endpoint hxxps://api[.]coderlicences[.]com/api/v1/transcription/transcribe Firebase project coderlicenses-13ee8 Firebase API key AIzaSyBGnWyP3jje9KDVf_pj0igWYYh5cu3mg3E Firebase sender ID 448382602126 Firebase app ID 1:448382602126:web:58616d5d9531a495b8b2df FCM VAPID key BNmJuixrQBYMK_djWLPVDP1yaZJfw1GhQKygf-Yj5sHsFnoJwDjwjzRCnlAfoksjnWmNbgo3Tb_A5iMEWhwkpBo Runtime marker window.__CL__ACTIVE__ = true Cookie pattern auth-wl-<WHITELABEL_KEY> on app[.]coderlicences[.]com coderlicences[.]com operates a white-label platform (internal name "wadi") distributed across 50 Chrome extensions that present themselves as independent WhatsApp CRM tools for Portuguese-speaking markets. Every analyzed extension in the network shares a single codebase, a single backend infrastructure, and a single shared API credential. Each customer receives a branded extension tied to their account on the operator portal. The shared behavior across all instances includes modifying WhatsApp Web's Content Security Policy via declarativeNetRequest, transmitting voice message audio to vendor servers, maintaining persistent communication channels via SSE and Firebase Cloud Messaging, and accessing WhatsApp's internal React state directly. None of these behaviors are described in the Chrome Web Store listings or user-facing documentation of any analyzed variant. Methodology Findings are based on static analysis of extension bundles obtained from the Chrome Web Store and publicly available Chrome Web Store metadata. The 50-extension network was surfaced using internal tooling that clusters listings by shared code fingerprints, backend infrastructure, and behavioral signatures. Analyzed variants were individually verified to share EXTENSION_API_KEY sSpKEML64a2X855FkIpGAdv4VLM72kgjgR0DyT9zGqK7Om6FPPGi2VsAaRCqx9Gw , the coderlicences[.]com backend endpoints, and the Firebase project coderlicenses-13ee8. No authenticated requests were made to coderlicences[.]com infrastructure. All findings are reproducible from the published bundles. Bundle structure Each extension ships five components: global.js — sets window.__CL__ACTIVE__ = true as a page-context presence flag contentScript.js — injects scripts into WhatsApp Web; relays plugin-typed postMessage calls to the background worker via chrome.runtime.sendMessage background.js (~1.4 MB) — API client, Firebase/FCM setup, audio recording pipeline with bundled LAME MP3 encoder, 80+ RPC methods app.js (~3.1 MB) — CRM UI; integrates with WhatsApp Web through React Fiber internals rules.json — modifies WhatsApp Web's Content Security Policy via Declarative Net Request Advertised functionality The extensions present as WhatsApp Web CRM tools: contact tagging, quick replies, scheduled messages, multi-account support, and sales pipeline management. The manifest declares storage , unlimitedStorage , tabs , cookies , notifications , and declarativeNetRequest . The cookies and declarativeNetRequest permissions are not explained to users in any analyzed listing. Undisclosed behavior: Content Security Policy modification Every extension replaces WhatsApp Web's Content Security Policy on every page load: { "action": { "type": "modifyHeaders", "responseHeaders": [{ "header": "Content-Security-Policy", "operation": "set", "value": "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;" }] }, "condition": { "urlFilter": "https://web.whatsapp.com/*", "resourceTypes": ["main_frame"] } } The replacement policy allows all sources, inline script, and eval. Undisclosed behavior: persistent vendor communication The background worker establishes two independent communication channels on startup. An authenticated SSE connection opens to api[.]coderlicences[.]com/api/v1/license/auth/events on every browser session, enabling real-time server-to-client messaging for any live installation. Firebase Cloud Messaging registration runs at install time, providing delivery when SSE is unavailable or the browser is idle. FCM messages survive browser restarts and are device-scoped. All API requests carry three identifying headers: Authorization: Bearer <session_token> , identifier: <WHITELABEL_KEY> , and device: <UUID> . The device UUID is stored in chrome.storage.local and serves as the per-install identifier across all vendor intera...