Is AiPrice(AliPrice) Sourcing Tool Beta safe?

Medium risk

AiPrice is medium risk. The extension routes toolbar interactions into its analytics wrapper. On the first tracked event, the GA queue adds page title, URL, and referrer; sendBeacon posts queued events when supported. No POST body was captured; endpoint only.

aiprice4v4.1.6Chrome Web Store
45Risk
Who publishes it

aiprice4 - 11 other listings from the same operator, 2 of them carrying a finding

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

User clicks queue page metadata for Google Analytics

The extension routes toolbar interactions into its analytics wrapper.

On the first tracked event, the GA queue adds page title, URL, and referrer; sendBeacon posts queued events when supported.

No POST body was captured; endpoint only.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You use a page toolbar control provided by the extension.

One shipped example is the Copy Link dropdown item, whose click handler calls the extension's analytics wrapper after copying the link.

The extension did this

The extension queues an analytics event that can include the page you are viewing.

On the first tracked event, the queue adds the page title, current URL, and referrer before later beacon delivery.

Page fields added to the first queued analytics event
  • Page title
    Wholesale Bluetooth Speaker - 1688.com (illustrative)

    Shows the name of the page where you used the extension control.

  • Current page URL
    https://detail.1688.com/offer/731238588927.html (illustrative)

    Identifies the exact page open in your browser when the event is queued.

  • Referrer
    https://s.1688.com/selloffer/offer_search.htm?keywords=speaker (illustrative)

    Shows the previous page or site that led you to the current page when the browser provides one.

Captured request
GEThttps://ssl.google-analytics.com/ga.js

Observed during dynamic analysis; this request loaded Google Analytics script code and did not include page metadata fields.

Captured request
POSThttps://www.google-analytics.com/g/collect

The source builds a browser beacon to this GA4 collect endpoint; no captured POST body was available.

The code that does this

Shipped code path from toolbar click to page metadata queue

Readable version

Toolbar Copy Link action records an analytics event

assets/js/content-script.js
methods: {  copyToClipboard() {    try {      let e = "",        t = "";      this.supportPlatforms.forEach((a => {        "" === `${e}`.trim() && a.validation() && (e = a.formatLink(), t = a.platform)      })), "" !== `${e}`.trim() ? ((0, ti.copyToClipboard)(e), Wext.app.$toast(null, "success", Wext.app.$i18n.t("pdp_copy_success"))) : Wext.app.$toast(null, "error", Wext.app.$i18n.t("pdp_copy_fail")), (0, Hr.PV)(null, null, {        category: "copy_link",        action: `copied_${t}`,        label: {          entry: "toolbar_dropdown"        }      })    } catch (e) {      Wext.app.$toast(null, "error", Wext.app.$i18n.t("pdp_copy_fail"))    }  }},render() {  return this.validation(this.tab) && this.isDropdownItem ? (0, Za.h)("div", {    class: "ap-toolbar-dropdown__item",    on: {      click: () => {        this.copyToClipboard()      }    }  }, [(0, Za.h)("div", Xa()([{}, {    class: {      "ap-icon-copy-link": !0    }  }])), this.$i18n.t("common_txt_copy_link")]) : ""}

Analytics wrapper forwards events to the Google Analytics queue

assets/js/chunk-common-d87c119a.js
g = async (e = {}, t = {}) => {  {    t = (0, r.isBoolean)(t) ? {      labelAsUrl: t    } : t, t = (0, r.isPlainObject)(t) ? t : {};    const {      labelAsUrl: a = !1,      direct: i = !1    } = t, {      event: o,      category: s,      action: c,      label: l,      value: u,      ...d    } = {      event: "",      category: "",      action: "",      ...e || {}    };    let m, h, g = o.trim() || "event",      _ = (0, r.isString)(s) ? s.trim() : void 0,      f = (0, r.isString)(c) ? c.trim() : void 0;    if ((0, r.isEmpty)(l) || (a && (0, r.isPlainObject)(l) ? (Object.entries(l).forEach((([e, t]) => {        null !== l[e] && void 0 !== l[e] && (l[e] = `${l[e]}`.replace(/[\/&=#]/g, encodeURIComponent))      })), m = (0, r.setURLQuery)("?", l, !1, !0).replace(/^\?/, "").replace(/^&/, "")) : ((0, r.isString)(l) || (0, r.isArray)(l) || (0, r.isPlainObject)(l)) && (m = (0, r.isString)(l) ? l : JSON.stringify(l))), (0, r.isNumber)(u) && !Number.isNaN(u) && (h = u), !g || !_) return;    await (0, n.Uv)(g, _, {      ...void 0 !== f && {        event_action: f      },      ...void 0 !== m && {        event_label: m      },      ...void 0 !== h && {        event_value: h      },      ...d    }, {      direct: i    }), p("[analysis][google] ", {      eventName: g,      eventCategory: _,      eventAction: f,      eventLabel: m,      eventValue: h,      ...d    })  }}

Google Analytics queue adds page fields and posts by beacon

assets/js/chunk-common-d87c119a.js
const c = "https://www.google-analytics.com",  l = `${c}/g/collect`,  p = "G-BH7LPM6XLX",  u = 30,  d = "dataLayerXap";let v = 0;const P = async (e = "", t = "", a = {}) => {  let i = [],    o = "",    n = "",    s = "",    c = "",    u = [],    d = "",    m = {};  if (!(0, r.isEmpty)(e)) {    try {      if (o = await b(), n = await S(), s = await f(), d = await _(), m = (0, r.getCommonHttpParams)(), i = (0, r.isString)(e) ? [          [e, t, a]        ] : [...e], i = i.filter((e => !!(e[0] || "").trim() && !!(e[1] || "").trim())), i.forEach((e => {          let t = (e[1] || "").trim(),            a = e[2] || {};          a.country_code = s, a.ext_uid = o, a.ext_version = m.version, u = [            ["en", t],            ["_ee", "1"],            ["_et", ""]          ], "page_view" !== t && Object.entries(a).map((([e, t]) => {            "number" !== typeof t || isNaN(t) || u.push([`epn.${e}`, t]), u.push([`ep.${e}`, String(t)])          })), c += `${(0,r.setURLQuery)("/",u).replace(/^\/\?/,"")}`, c += "\n"        })), c = c.trim(), c.length > 0) {        const e = globalThis.screen?.width && globalThis.screen?.height ? `${globalThis.screen.width}x${globalThis.screen.height}` : "",          t = (0, r.setURLQuery)(l, {            v: "2",            tid: p,            cid: o,            sid: n,            sr: e,            dl: globalThis.document?.location?.href || "",            dr: globalThis.document?.referrer || "",            dt: globalThis.document?.title || "",            ul: d,            sct: 1,            seg: 1,            _et: 100,            _p: (0, r.randomStr)(9, "0123456789"),            _s: ++v          });        if (navigator?.sendBeacon && navigator.sendBeacon(t, c)) return !0;        if (globalThis.fetch) {          const e = await fetch(t, {            method: "POST",            body: c,            keepalive: !0          });          return e.ok        }      }    } catch (e) {}    return !1  }};let T = !1;const A = async (e = "", t = "", a = {}, o = {}) => {  const {    direct: n = !1  } = o, s = (e = "", t = "", a = "", o, n = "") => {    const s = () => {      let e = n;      const t = e => (0, r.isPlainObject)(e) || (0, r.isArray)(e);      if ((0, r.isString)(n) && !(0, r.isEmpty)(n)) {        try {          e = JSON.parse(n)        } catch (e) {}        if (!t(e)) try {          e = (0, r.getAllURLQuery)(`/?${n}`)        } catch (e) {}      }      return t(e) || (e = {}), e    };    (0, i.zj)({      category: e,      action: t,      name: a,      value: o,      details: s()    })  };  if (n) {    const r = await P(e, t, a);    s(t, a.event_action, a.event_name, a.event_value, a.event_label), !r && g && "event" === e && w.set([e, t, a])  } else if (navigator?.sendBeacon) {    let r = globalThis[d] = globalThis[d] || [];    T || (T = !0, "page_view" !== e && r.push(["page_view", "page_view", {      page_title: document.title,      page_location: document.location.href,      page_referrer: document.referrer    }])), r.push([e, t, a]), s(t, a.event_action, a.event_name, a.event_value, a.event_label)  } else !g && browser?.runtime?.sendMessage ? browser.runtime.sendMessage({    type: m.push2gaq,    payload: [e, t, a]  }) : g && "event" === e && w.set([e, t, a])}
Analytics destination named by the shipped code
    • www.google-analytics.com

    Receives the GA4 collect beacon built with measurement ID G-BH7LPM6XLX.

Updated 30 September 2026dbjldigbjceebginhcnmjnigbocicokh