Is Whatfix Studio safe to use?

Whatfix Studio has a security risk score of 97.74/100 (CRITICAL risk). Our security analysis detected 5308 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of Whatfix Studio?

Based on our automated security analysis, Whatfix Studio presents critical risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Chrome Web Store Verified

Whatfix Studio

by [email protected] · 10.0K users · 4.7 rating

256a4fbf-2aba-5fba-a581-353da7b0a801 | v2026.09.09.2105

CRITICAL risk

No change since v2026.09.09.1014

Risk verdict

Do not install

Score-based assessment (critical risk, 98/100). No analyst review available.

Analysis record

Analysed: Yesterday
Version: v2026.09.09.2105
Artifact: SHA256 5D7…F4E
Source: Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

1000 detail rows

Showing 25 of 150 · highest severity first

YARA Rule Matches

20 rules

Severity	Rule	Hits	Files	Metadata
HIGH	`supply chain sourcemap appended iife`	1	whatfix.com/modules/dp/bugfix-6047657-760/dp.js	-
LOW	`LocalStorageShouldNotBeUsed`	38	whatfix.com/lib/enhanced-editor/enhancededitor.3252.6837c6c03652783fd7f9.chunk.jswhatfix.com/survey/wfx-survey-internal.nocache.jswhatfix.com/lib/enhanced-editor/enhancededitor.6911.12c58d40b48b20803dcb.chunk.js +35 more	-
LOW	`DebuggerStatementsShouldNotBeUsed`	7	whatfix.com/lib/js/linter-8.30.0.min.jswhatfix.com/lib/js/codemirror-5.40.0-3.min.jswhatfix.com/lib/enhanced-editor/enhancededitor.4272.09abad5bd7057eb85548.chunk.js +4 more	-
LOW	`UsingCommandLineArguments`	1	whatfix.com/lib/js/linter-8.30.0.min.js	-
LOW	`ServerHostnameNotVerified`	1	whatfix.com/lib/enhanced-editor/enhancededitor.1188.7990526518dfd66bb18b.chunk.js	-
LOW	`credential env files`	56	whatfix.com/lib/enhanced-editor/enhancededitor.4568.0bde389279c71f15450c.chunk.jswhatfix.com/lib/enhanced-editor/enhancededitor.7281.4e48ca7c0b635985df2b.chunk.jswhatfix.com/lib/enhanced-editor/enhancededitor.1152.42fd8965f4b3ee621efb.chunk.js +53 more	-
LOW	`postinstall persistence mechanism`	64	whatfix.com/lib/enhanced-editor/enhancededitor.5574.f1a032f6ae30f65db378.chunk.jswhatfix.com/editorembed/editorembed.devmode.jswhatfix.com/lib/js/cap-studio-modules/studio-module-e4ecfe4774309f32cccf.chunk.js +61 more	-
LOW	`HavingAPermissiveCrossOriginResourceSharingPolicy`	6	whatfix.com/lib/enhanced-editor/enhancededitor.6911.12c58d40b48b20803dcb.chunk.jswhatfix.com/lib/enhanced-editor/enhancededitor.6127.f513d13450e7d897ecce.chunk.jswhatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.892.chunk.js +3 more	-
LOW	`NoUseWeakRandom`	80	whatfix.com/modules/obs/bugfix-487c78f-749/obs.min.jswhatfix.com/lib/enhanced-editor/enhancededitor.9376.6718592a6b6d58e768f5.chunk.jswhatfix.com/sso/glue/glue.nocache.js +77 more	-
LOW	`postinstall file download`	148	extension.background/extension.background.nocache.jswhatfix.com/lib/js/ajax-libs-pdfmake-0.1.66-pdfmake.min.jswhatfix.com/modules/cap/bugfix-45a77a2-761/whatfix-cap.276.chunk.js +145 more	-
LOW	`NoUseEval`	8	whatfix.com/lib/enhanced-editor/enhancededitor.3436.41581d6b655fc3f3c532.chunk.jswhatfix.com/modules/cap/bugfix-45a77a2-761/whatfix-cap.247.chunk.jswhatfix.com/lib/js/linter-8.30.0.min.js +5 more	-
LOW	`SQLInjection`	17	whatfix.com/glue/C5FD51D54C69258E6029DA37A113A5A3.cache.jswhatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.149.chunk.jswhatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.547.js +14 more	-
LOW	`UntrustedContentShouldNotBeIncluded`	21	whatfix.com/workflowengine/workflowengine.nocache.jswhatfix.com/modules/cb/bugfix-bfdffeb-757/cb.547.min.jswhatfix.com/modules/cb/bugfix-bfdffeb-757/cb.547.js +18 more	-
LOW	`postinstall crypto operations`	22	whatfix.com/new-widgets/react-dom/react-dom.d38596027cd4aaf70d2d.chunk.jswhatfix.com/modules/dp/bugfix-6047657-760/dp.31.chunk.jswhatfix.com/lib/enhanced-editor/enhancededitor.8969.ad60c512f7ff0bad3e20.chunk.js +19 more	-
LOW	`postinstall obfuscation`	201	whatfix.com/lib/enhanced-editor/enhancededitor.286.7835c98a3e413b20bf7f.chunk.jswhatfix.com/glue/2B6036EA3EAFB6A0B379D2310C471B39.cache.svgwhatfix.com/modules/cb/bugfix-bfdffeb-757/cb.547.min.js +198 more	-
LOW	`postinstall registry modification`	42	whatfix.com/glue/C5FD51D54C69258E6029DA37A113A5A3.cache.jswhatfix.com/modules/gw/bugfix-1cd5c6d-712/gw.jswhatfix.com/mirror/mirror.widget.js +39 more	-
LOW	`AlertStatementsShouldNotBeUsed`	6	whatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.892.chunk.jswhatfix.com/lib/enhanced-editor/enhancededitor.9377.bc5724d7d9f0d08d2f02.chunk.jswhatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.547.min.js +3 more	-
LOW	`postinstall environment access`	7	whatfix.com/modules/up/bugfix-d14443b-762/7b10ea0f5a0f66e96e83.ttfwhatfix.com/modules/dp/bugfix-6047657-760/e97f258d30bb2db55931.ttfwhatfix.com/modules/dp/bugfix-6047657-760/3e117ae2762d584909bd.ttf +4 more	-
LOW	`postinstall file manipulation`	122	whatfix.com/workflowengine/workflowengine.nocache.jswhatfix.com/lib/js/cap-studio-modules/studio-module.nocache.jswhatfix.com/lib/enhanced-editor/enhancededitor.286.7835c98a3e413b20bf7f.chunk.js +119 more	-
LOW	`postinstall network communication`	2	whatfix.com/entscript/scripts/afcf9010-d824-11eb-8d66-32b5f385aed9.jswhatfix.com/lib/enhanced-editor/enhancededitor.5144.f114d4c41d86ae297d28.chunk.js	-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

3,363 total

...

Network indicators are queued for lazy loading

Scroll this section into view to load the detailed rows.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

Noisy-finding weight

x1.00

Publisher domain

whatfix.com

Observed

Store verification signal

Limited signal

Limited

Extension portfolio

Portfolio

12 evidence rows available.

Finding Categories

Malware Signatures

Obfuscation

Network

3,363

IoC Indicators

YARA Rules Matched

20 rules(850 hits)

supply chain sourcemap appended iife LocalStorageShouldNotBeUsed DebuggerStatementsShouldNotBeUsed UsingCommandLineArguments ServerHostnameNotVerified credential env files postinstall persistence mechanism HavingAPermissiveCrossOriginResourceSharingPolicy NoUseWeakRandom postinstall file download NoUseEval SQLInjection UntrustedContentShouldNotBeIncluded postinstall crypto operations postinstall obfuscation postinstall registry modification +4 more

Requested Permissions

9 permissions

*://*/*

Dangerous

<all_urls>

Access and modify data on every website you visit

Dangerous

http://*/*

Dangerous

https://*/*

Dangerous

Read and modify cookies on all sites

High

storage

Low

alarms

Low

webNavigation

Low

scripting

Low

Security Analysis Summary

Security Analysis Overview

Whatfix Studio is a Chrome Web Store extension published by [email protected]. Version 2026.09.09.2105 has been analyzed by the Risky Plugins security platform, receiving a risk score of 97.74/100 (CRITICAL risk) based on 5308 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

High: 24 finding(s)
Medium: 3490 finding(s)
Low: 1794 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Whatfix Studio is published by [email protected] on the Chrome Web Store marketplace. The extension has approximately 10K users.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Chrome version history

Risk trend by version

6 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected

Change since first

+22

Change from previous

No change

Versions:

First analyzed version

2026.01.16.2207

Jan 21, 2026

Risk range

74 to 98

Across analyzed versions

Latest analyzed version

2026.09.09.2105

Sep 18, 2026

Selected version

critical

Version

v2026.09.09.2105

Yesterday

Risk score

Findings

5312

Change vs previous

No change

Pick any point on the chart to explore that version's code below.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

About This Extension

Drive user adoption and maximize ROI from your software investments with Whatfix’s contextual in-app guidance and ScreenSense AI technology. Whether you are in L&D, Product, or IT, use Whatfix Studio to: - Create Interactive Walkthroughs and Flows - Build risk-free simulations and AI Roleplay scenarios - Deploy Smart Tips, Task Lists, and Pop-ups - Repurpose content into multi-format training materials - Analyze user friction and behavior Whatfix’s product capabilities include: • Digital Adoption Platform: Drive adoption with contextual in-app guidance embedded directly in the flow of work. Build Interactive Walkthroughs, Task Lists, and Smart Tips that overlay any application. Empower users via Self Help with AI conversational search to deliver just-in-time support without disrupting their workflow. • Product Analytics: Analyze every user journey to uncover the 'why' behind the data. With AutoCapture, perform no-code event tracking on every interaction without engineering resources, ensuring fast time-to-insight. The Insights Agent acts as your dedicated product analyst, automatically pinpointing friction points and delivering tailored recommendations to drive adoption. • Mirror: Simulate without dependencies by creating interactive, hands-on replicas of any application in a risk-free sandbox environment. Deliver Guided Experiences directly inside the simulation to ensure faster onboarding. Combine Simulated Training with AI Roleplay to help users master complex workflows and high-stakes conversations Drive adoption, reduce support tickets, and maximize ROI with one unified platform. Learn more about Whatfix at https://whatfix.com/

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

fisglobal_MBP_ext

[email protected]

CRITICAL 10 users

Whatfix for ATOSS_Salesforce

[email protected]

HIGH 1 users

Whatfix for McDonalds

[email protected]

HIGH 9 users

Whatfix for Midway Staffing

[email protected]

HIGH

randstad_poc

[email protected]

MINIMAL 6 users

BI_POC

[email protected]

MINIMAL

Whatfix Studio

Analysis record

Evidence ledger

OBFUSCATION-UNICODE_HEAVY-whatfix.com/start/start.nocache.js-2165

OBFUSCATION-UNICODE_HEAVY-whatfix.com/tasker/tasker.nocache.js-2521

OBFUSCATION-UNICODE_HEAVY-whatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.547.js-3824

OBFUSCATION-UNICODE_HEAVY-whatfix.com/lib/enhanced-editor/enhancededitor.4272.09abad5bd7057eb85548.chunk.js-2

OBFUSCATION-UNICODE_HEAVY-whatfix.com/modules/cap/bugfix-45a77a2-761/whatfix-cap.276.chunk.js-1

OBFUSCATION-UNICODE_HEAVY-whatfix.com/end/end.nocache.js-2253

OBFUSCATION-UNICODE_HEAVY-whatfix.com/workflowengine/workflowengine.nocache.js-3611

OBFUSCATION-UNICODE_HEAVY-whatfix.com/editortroubleshoot/editortroubleshoot.nocache.js-1225

OBFUSCATION-UNICODE_HEAVY-whatfix.com/lib/enhanced-editor/enhancededitor.6127.f513d13450e7d897ecce.chunk.js-2

OBFUSCATION-UNICODE_HEAVY-whatfix.com/lib/enhanced-editor/enhancededitor.4313.1316cdfb7752d117f1b5.chunk.js-1

OBFUSCATION-UNICODE_HEAVY-whatfix.com/topframe/topframe.nocache.js-918

OBFUSCATION-UNICODE_HEAVY-whatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.463.chunk.js-1

OBFUSCATION-UNICODE_HEAVY-whatfix.com/glue/C5FD51D54C69258E6029DA37A113A5A3.cache.js-10167

OBFUSCATION-UNICODE_HEAVY-whatfix.com/deck/deck.nocache.js-2408

OBFUSCATION-UNICODE_HEAVY-whatfix.com/lib/js/cap-studio-modules/studio-module-e4ecfe4774309f32cccf.chunk.js-1

OBFUSCATION-UNICODE_HEAVY-whatfix.com/sso/editorembed/editorembed.nocache.js-14116

OBFUSCATION-UNICODE_HEAVY-whatfix.com/modules/up/bugfix-d14443b-762/up.887.chunk.js-1

OBFUSCATION-UNICODE_HEAVY-whatfix.com/editorembed/91C51ADC6410E6F8F7534EA3382F50D1.cache.js-14040

OBFUSCATION-UNICODE_HEAVY-whatfix.com/sso/glue/glue.nocache.js-10176

OBFUSCATION-UNICODE_HEAVY-extension.foreground/extension.foreground.nocache.js-1663

OBFUSCATION-UNICODE_HEAVY-whatfix.com/lib/js/whatfix-dap-ui/whatfix-dap-ui.892.chunk.js-1

OBFUSCATION-UNICODE_HEAVY-whatfix.com/modules/gw/bugfix-1cd5c6d-712/gw.691.chunk.js-1

OBFUSCATION-UNICODE_HEAVY-whatfix.com/survey/survey.nocache.js-1509

OBFUSCATION-EXCESSIVE_PRIVATE_USE_AREA-whatfix.com/lib/enhanced-editor/static/css/5788.a0b5978a30171355e154.css-0

OBFUSCATION-FROMCHARCODE_BULK-whatfix.com/workflowengine/workflowengine.nocache.js-3222

YARA Rule Matches

Network Indicators

Publisher Evidence

Finding Categories

YARA Rules Matched

Requested Permissions

Security Analysis Summary

Security Analysis Overview

Risk Assessment

Findings Breakdown

What Was Analyzed

Developer Information

Recommendation

Risk trend by version

About This Extension

Frequently Asked Questions

Similar Extensions

fisglobal_MBP_ext

Whatfix for ATOSS_Salesforce

Whatfix for McDonalds

Whatfix for Midway Staffing

randstad_poc

BI_POC