Is AiPrice(AliPrice) Sourcing Tool Beta safe?
AiPrice is medium risk. The extension routes toolbar interactions into its analytics wrapper. On the first tracked event, the GA queue adds page title, URL, and referrer; sendBeacon posts queued events when supported. No POST body was captured; endpoint only.
Who publishes itaiprice4 - 11 other listings from the same operator, 2 of them carrying a finding
aiprice4 - 11 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
11 other listings published from this account, 68k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
User clicks queue page metadata for Google Analytics
The extension routes toolbar interactions into its analytics wrapper.
On the first tracked event, the GA queue adds page title, URL, and referrer; sendBeacon posts queued events when supported.
No POST body was captured; endpoint only.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You use a page toolbar control provided by the extension.
One shipped example is the Copy Link dropdown item, whose click handler calls the extension's analytics wrapper after copying the link.
The extension queues an analytics event that can include the page you are viewing.
On the first tracked event, the queue adds the page title, current URL, and referrer before later beacon delivery.
- Page titleWholesale Bluetooth Speaker - 1688.com (illustrative)
Shows the name of the page where you used the extension control.
- Current page URLhttps://detail.1688.com/offer/731238588927.html (illustrative)
Identifies the exact page open in your browser when the event is queued.
- Referrerhttps://s.1688.com/selloffer/offer_search.htm?keywords=speaker (illustrative)
Shows the previous page or site that led you to the current page when the browser provides one.
Observed during dynamic analysis; this request loaded Google Analytics script code and did not include page metadata fields.
The source builds a browser beacon to this GA4 collect endpoint; no captured POST body was available.
Shipped code path from toolbar click to page metadata queue
Toolbar Copy Link action records an analytics event
assets/js/content-script.jsmethods: { copyToClipboard() { try { let e = "", t = ""; this.supportPlatforms.forEach((a => { "" === `${e}`.trim() && a.validation() && (e = a.formatLink(), t = a.platform) })), "" !== `${e}`.trim() ? ((0, ti.copyToClipboard)(e), Wext.app.$toast(null, "success", Wext.app.$i18n.t("pdp_copy_success"))) : Wext.app.$toast(null, "error", Wext.app.$i18n.t("pdp_copy_fail")), (0, Hr.PV)(null, null, { category: "copy_link", action: `copied_${t}`, label: { entry: "toolbar_dropdown" } }) } catch (e) { Wext.app.$toast(null, "error", Wext.app.$i18n.t("pdp_copy_fail")) } }},render() { return this.validation(this.tab) && this.isDropdownItem ? (0, Za.h)("div", { class: "ap-toolbar-dropdown__item", on: { click: () => { this.copyToClipboard() } } }, [(0, Za.h)("div", Xa()([{}, { class: { "ap-icon-copy-link": !0 } }])), this.$i18n.t("common_txt_copy_link")]) : ""}Analytics wrapper forwards events to the Google Analytics queue
assets/js/chunk-common-d87c119a.jsg = async (e = {}, t = {}) => { { t = (0, r.isBoolean)(t) ? { labelAsUrl: t } : t, t = (0, r.isPlainObject)(t) ? t : {}; const { labelAsUrl: a = !1, direct: i = !1 } = t, { event: o, category: s, action: c, label: l, value: u, ...d } = { event: "", category: "", action: "", ...e || {} }; let m, h, g = o.trim() || "event", _ = (0, r.isString)(s) ? s.trim() : void 0, f = (0, r.isString)(c) ? c.trim() : void 0; if ((0, r.isEmpty)(l) || (a && (0, r.isPlainObject)(l) ? (Object.entries(l).forEach((([e, t]) => { null !== l[e] && void 0 !== l[e] && (l[e] = `${l[e]}`.replace(/[\/&=#]/g, encodeURIComponent)) })), m = (0, r.setURLQuery)("?", l, !1, !0).replace(/^\?/, "").replace(/^&/, "")) : ((0, r.isString)(l) || (0, r.isArray)(l) || (0, r.isPlainObject)(l)) && (m = (0, r.isString)(l) ? l : JSON.stringify(l))), (0, r.isNumber)(u) && !Number.isNaN(u) && (h = u), !g || !_) return; await (0, n.Uv)(g, _, { ...void 0 !== f && { event_action: f }, ...void 0 !== m && { event_label: m }, ...void 0 !== h && { event_value: h }, ...d }, { direct: i }), p("[analysis][google] ", { eventName: g, eventCategory: _, eventAction: f, eventLabel: m, eventValue: h, ...d }) }}Google Analytics queue adds page fields and posts by beacon
assets/js/chunk-common-d87c119a.jsconst c = "https://www.google-analytics.com", l = `${c}/g/collect`, p = "G-BH7LPM6XLX", u = 30, d = "dataLayerXap";let v = 0;const P = async (e = "", t = "", a = {}) => { let i = [], o = "", n = "", s = "", c = "", u = [], d = "", m = {}; if (!(0, r.isEmpty)(e)) { try { if (o = await b(), n = await S(), s = await f(), d = await _(), m = (0, r.getCommonHttpParams)(), i = (0, r.isString)(e) ? [ [e, t, a] ] : [...e], i = i.filter((e => !!(e[0] || "").trim() && !!(e[1] || "").trim())), i.forEach((e => { let t = (e[1] || "").trim(), a = e[2] || {}; a.country_code = s, a.ext_uid = o, a.ext_version = m.version, u = [ ["en", t], ["_ee", "1"], ["_et", ""] ], "page_view" !== t && Object.entries(a).map((([e, t]) => { "number" !== typeof t || isNaN(t) || u.push([`epn.${e}`, t]), u.push([`ep.${e}`, String(t)]) })), c += `${(0,r.setURLQuery)("/",u).replace(/^\/\?/,"")}`, c += "\n" })), c = c.trim(), c.length > 0) { const e = globalThis.screen?.width && globalThis.screen?.height ? `${globalThis.screen.width}x${globalThis.screen.height}` : "", t = (0, r.setURLQuery)(l, { v: "2", tid: p, cid: o, sid: n, sr: e, dl: globalThis.document?.location?.href || "", dr: globalThis.document?.referrer || "", dt: globalThis.document?.title || "", ul: d, sct: 1, seg: 1, _et: 100, _p: (0, r.randomStr)(9, "0123456789"), _s: ++v }); if (navigator?.sendBeacon && navigator.sendBeacon(t, c)) return !0; if (globalThis.fetch) { const e = await fetch(t, { method: "POST", body: c, keepalive: !0 }); return e.ok } } } catch (e) {} return !1 }};let T = !1;const A = async (e = "", t = "", a = {}, o = {}) => { const { direct: n = !1 } = o, s = (e = "", t = "", a = "", o, n = "") => { const s = () => { let e = n; const t = e => (0, r.isPlainObject)(e) || (0, r.isArray)(e); if ((0, r.isString)(n) && !(0, r.isEmpty)(n)) { try { e = JSON.parse(n) } catch (e) {} if (!t(e)) try { e = (0, r.getAllURLQuery)(`/?${n}`) } catch (e) {} } return t(e) || (e = {}), e }; (0, i.zj)({ category: e, action: t, name: a, value: o, details: s() }) }; if (n) { const r = await P(e, t, a); s(t, a.event_action, a.event_name, a.event_value, a.event_label), !r && g && "event" === e && w.set([e, t, a]) } else if (navigator?.sendBeacon) { let r = globalThis[d] = globalThis[d] || []; T || (T = !0, "page_view" !== e && r.push(["page_view", "page_view", { page_title: document.title, page_location: document.location.href, page_referrer: document.referrer }])), r.push([e, t, a]), s(t, a.event_action, a.event_name, a.event_value, a.event_label) } else !g && browser?.runtime?.sendMessage ? browser.runtime.sendMessage({ type: m.push2gaq, payload: [e, t, a] }) : g && "event" === e && w.set([e, t, a])}- www.google-analytics.com
Receives the GA4 collect beacon built with measurement ID G-BH7LPM6XLX.