Is Ali Assist | AliExpress Shopping Assistant safe?

Medium risk

Ali Assist redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

When an AliExpress product or cart page is loading, Ali Assist changes the active tab URL to an AliExpress deep-link URL. The destination includes the current AliExpress page URL as dl_target_url, with product-page query parameters stripped in one redirect path.

Infinityv5.3.2Chrome Web Store
49Risk
Who publishes it

Infinity - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Infinity
Website
sites.google.com/view/alinext/home

Same store account

1 other listing published from this account, 1k+ users between them. 1 of them carries a finding.

AliSave - Download AliExpress Images & Videos1k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Background Affiliate Redirect on Every AliExpress Page

Opening an AliExpress product or cart page makes Ali Assist's worker redirect the tab through an affiliate link (s.click.aliexpress.com) carrying its own code before the page loads, replacing any affiliate tag already present.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a product page or your cart on AliExpress.

The extension did this

The extension's background service worker immediately redirects your tab through an AliExpress affiliate link carrying its own affiliate code, then lands you back on the same page.

No click on any extension button is required, the redirect fires from a background listener before you interact with the page.

Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DEQqQk3&dl_target_url=https://www.aliexpress.com/item/1005009876543210.html

302 redirect back to https://www.aliexpress.com/item/1005009876543210.html?aff_fcid=09791364b94f402487a49309d0651d23-1786686415862-08687-_DEQqQk3&tt=CPS_NORMAL&aff_fsk=_DEQqQk3&aff_platform=shareComponent-detail&sk=_DEQqQk3&aff_trace_key=09791364b94f402487a49309d0651d23-1786686415862-08687-_DEQqQk3&terminal_id=6ead2c6230f8432cb879969788e0f6ec&afSmartRedirect=y

What changes on the landing URL after the extension's redirect
  • Extension's affiliate code
    _DEQqQk3

    A fixed ID hardcoded into the extension that AliExpress now credits for this visit.

  • Attribution platform tag
    shareComponent-detail

    Marks the visit as arriving through a share/redirect flow rather than direct navigation.

  • Trace / terminal ID
    6ead2c6230f8432cb879969788e0f6ec

    Session identifiers AliExpress uses to link the purchase back to the extension's affiliate account.

  • Original page URL
    https://www.aliexpress.com/item/1005009876543210.html

    The exact item or cart page you were viewing before the redirect appended tracking parameters to it.

The code that does this

The two background listeners that perform the redirect, from the extension's shipping source.

Readable version

Listener 1 — item pages, renamed

chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {  if (changeInfo.status === 'loading') {    chrome.tabs.query({ active: true, currentWindow: true }, function(tabs) {      const activeTab = tabs[0];      const activeTabId = activeTab.id;      const activeUrl = activeTab.url;      const redirectUrl = 'https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DEQqQk3&dl_target_url=' + activeTab.url.split('?')[0];      const isItemPage = activeUrl.match('aliexpress.com/item/') || activeUrl.match('aliexpress.ru/item/');      const alreadyTagged = activeUrl.indexOf('_DEQqQk3') !== -1;      if (isItemPage && !alreadyTagged) {        chrome.tabs.update(activeTabId, { url: redirectUrl });      }    });  }});
Where the redirect routes through
    • s.click.aliexpress.com

    AliExpress's affiliate click-tracking service. Gets the hardcoded code (_DEQqQk3) and redirects back to the page carrying it, crediting the purchase.

What it can do

Permissions this extension asks for, as declared in version 5.3.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Watch every request your browser makes

    webRequest

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Ali Assist | AliExpress Shopping Assistant contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Ali Assist | AliExpress Shopping Assistant sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

Updated 30 September 2026ekemheaddpiepanchcjfamlimkeeplgo