Is 1688 AlphaShop: AI Sourcing & Image Search safe?

Medium risk

1688 AlphaShop is medium risk. At browser session start, 1688 AlphaShop sends a persistent browser identifier from extension storage to an Alibaba logging endpoint. Dynamic analysis saw the same Chrome ID in the startup request, linking sessions from one install.…

1688 AIBUY (Official Global Sourcing AI Tool)v0.0.27Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Startup beacon sends a persistent Chrome ID to Alibaba logging

At browser session start, 1688 AlphaShop sends a persistent browser identifier from extension storage to an Alibaba logging endpoint.

Dynamic analysis saw the same Chrome ID in the startup request, linking sessions from one install.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You start a browser session with the extension installed.

The extension did this

The background worker sends a startup logging request with a persistent browser identifier.

The identifier is reused from extension storage when it already exists.

Fields sent in the startup logging request
  • Persistent Chrome ID
    a7eb3e4d-6437-4c3d-b95b-f14df9c55153

    This browser-specific ID lets repeated startup beacons from the same installation be connected over time.

  • Extension ID
    ecpkhbhhpfjkkcedaejmpaabpdgcaegc

    This identifies which installed extension generated the request.

  • Extension version
    0.0.27

    This shows which release of the extension was running when the beacon was sent.

  • Startup event marker
    bgsw_pv

    This labels the request as a background-worker page-view event rather than a feature request you initiated.

Captured request
GEThttps://1688-global.cn-hongkong.log.aliyuncs.com/logstores/aibuy/track?APIVersion=0.6.0&extenstionId=ecpkhbhhpfjkkcedaejmpaabpdgcaegc&ver=0.0.27&chromeId=a7eb3e4d-6437-4c3d-b95b-f14df9c55153&action=bgsw_pv

The request was observed during dynamic analysis; no response body was recorded in the claim evidence.

What's stored on your device

The extension keeps one browser-specific ID locally, so later startup requests can reuse the same value.

Location
chrome.storage.local key 'aibuy-chromeId'
Contents
{  "aibuy-chromeId": "a7eb3e4d-6437-4c3d-b95b-f14df9c55153"}
The code that does this

Storage-backed identifier and startup logging request

Readable version

Persistent ID helper

deobfuscated/static/background/index.js:1489
S = () => a && !/^err_/.test(a) ? Promise.resolve(a) : (0, i.getItem)("aibuy-chromeId").then(e => e ? (a = e, e) : (a = m(), (0, i.setItem)("aibuy-chromeId", a), a)).catch(() => a || (a = "err_" + m()))

Startup beacon

deobfuscated/static/background/index.js:2554-2559
(0, l.getChromeId)().then(e => {  let t = (0, l.getId)();  fetch(`https://1688-global.cn-hongkong.log.aliyuncs.com/logstores/aibuy/track?APIVersion=0.6.0&extenstionId=${t}&ver=${(0,l.getVersion)()}&chromeId=${e}&action=bgsw_pv`)}).catch(() => {  console.log("getChromeId error")});
Destination receiving the startup identifier
    • 1688-global.cn-hongkong.log.aliyuncs.com

    Alibaba Cloud Log Service host receiving the extension startup tracking request.

Reverse image search posts page images with a browser fingerprint

The reverse image search feature uploads the selected image or screenshot to overseaplugin.1688.com with page source, extension version, and a browser-derived terminal ID.

Traffic didn't capture an upload body; fields reflect shipped code.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You invoke the reverse image search feature from the page or image context menu.

The extension did this

The extension prepares an upload request containing the image data and browser-derived context.

The upload path is tied to the image-search API in the background bundle.

Fields assembled for the image-upload request
  • Selected image data
    data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAFgwJ/l83p2wAAAABJRU5ErkJggg== (illustrative)

    The image you choose for reverse search can be sent as a complete base64-encoded image.

  • Page source
    https://www.amazon.com/dp/B0C7QKJ4 (illustrative)

    This can associate the image search with the site or page where the image was found.

  • Browser version label
    Chrome_128.0.6613.120 (illustrative)

    This groups the request by browser family and version, adding a stable device-context signal.

  • Extension version
    0.0.27

    This shows which release of the extension generated the image-search request.

Captured request
POSThttps://overseaplugin.1688.com/image/upload

The passive traffic evidence did not record an /image/upload request body; the POST target is the one constructed by the shipped source code.

The code that does this

Image-search trigger, upload request, and browser label

Readable version

Image-upload API call

deobfuscated/static/background/index.js:317-364
(0, o.setBaseURL)(n.isPre ? "https://pre-overseaplugin.1688.com" : "https://overseaplugin.1688.com");let i = (0, s.getVersion)(),  l = (e, t) => (0, o.postRequest)("/recommend/sameOfferRecommendBySubject", {    body: Object.assign({      beginPage: 1,      pageSize: 18,      keyword: "",      language: (0, n.getCurrnetLang)() || n.LanguageEnum.en_US,      currency: (0, n.getCurrency)() || n.CurrencyEnum.USD,      region: n.RegionEnum.HK,      source: t,      terminalId: (0, n.getTerminalId)(),      version: i    }, e)  }),  c = (e, t) => (0, o.postRequest)("/recommend/sameOfferCompare", {    body: Object.assign({      beginPage: 1,      pageSize: 4,      keyword: "",      language: (0, n.getCurrnetLang)() || n.LanguageEnum.en_US,      currency: (0, n.getCurrency)() || n.CurrencyEnum.USD,      region: n.RegionEnum.HK,      source: t,      terminalId: (0, n.getTerminalId)(),      version: i    }, e)  }),  u = (e, t) => (0, o.postRequest)("/recommend/relativeOfferRecommend", {    body: Object.assign({      beginPage: 1,      pageSize: 18,      language: (0, n.getCurrnetLang)() || n.LanguageEnum.en_US,      currency: (0, n.getCurrency)() || n.CurrencyEnum.USD,      region: n.RegionEnum.HK,      source: t,      terminalId: (0, n.getTerminalId)(),      version: i    }, e)  }),  g = (e, t) => (0, o.postRequest)("/image/upload", {    body: {      imageBase64: e,      source: t,      terminalId: (0, n.getTerminalId)(),      version: i    }  })

Context-menu trigger

deobfuscated/static/background/index.js:2522-2538
(0, l.addContextMenusClickEventListener)(function(e, t) {  switch (e.menuItemId) {    case "aibuy_screenshot_search":      (0, l.screenshot)().then(e => g(i.EventNameEnum.SCREENSHOT_SEARCH, {        base64Image: e,        tab: t      })).catch(e => {        console.log(e)      });      break;    case "aibuy_search_image":      g(i.EventNameEnum.IMAGE_SRC_SEARCH, {        srcUrl: e.srcUrl,        tab: t      }).catch(e => {        console.log(e)      });      break;    case "aibuy_search_selection":      g(i.EventNameEnum.TEXT_SEARCH, {        selectionText: e.selectionText,        tab: t      }).catch(e => {        console.log(e)      });      break;    case "aibuy_ocr_image":      g(i.EventNameEnum.IMAGE_OCR_TRANSLATE, {        srcUrl: e.srcUrl,        tab: t      })  }})

Browser label helper

deobfuscated/static/background/index.js:1427-1429
b = () => {  let e;  return (e = (e = self.navigator.userAgent).toLowerCase()).indexOf("msie") >= 0 ? "IE_" + (e.match(/msie ([\d.]+)/)[1] || "") : e.indexOf("firefox") >= 0 ? "Firefox_" + (e.match(/firefox\/([\d.]+)/)[1] || "") : e.indexOf("chrome") >= 0 ? "Chrome_" + (e.match(/chrome\/([\d.]+)/)[1] || "") : e.indexOf("opera") >= 0 ? "Opera_" + (e.match(/opera.([\d.]+)/)[1] || "") : e.indexOf("safari") >= 0 ? "Safari_" + (e.match(/version\/([\d.]+)/)[1] || "") : e.indexOf("edge") >= 0 ? "Edge_" + (e.match(/edge\/([\d.]+)/)[1] || "") : e.indexOf("maxthon") >= 0 ? "maxthon_" + (e.match(/maxthon\/([\d.]+)/)[1] || "") : e.indexOf("qqbrowser") >= 0 ? "qqbrowser_" + (e.match(/qqbrowser\/([\d.]+)/)[1] || "") : e.indexOf("se 2.x") >= 0 ? "sougou" : "unknown_0.0.0"}
Destination used by the reverse image search feature
    • overseaplugin.1688.com

    1688 overseas plugin API host receiving reverse image search uploads from the extension code path.

Updated 30 September 2026ecpkhbhhpfjkkcedaejmpaabpdgcaegc