Is Ali Hunter - AliExpress Dropship safe?

Medium risk

Ali Hunter sends AliExpress product URLs to a Glitch service and rewrites AliExpress pages through affiliate links.

When you open an AliExpress product page, Ali Hunter sends the current page URL to a Glitch-hosted service and may redirect the tab to the returned search link. It also rewrites AliExpress item and cart pages through a hardcoded AliExpress affiliate deep-link endpoint.

One Technologyv3.1.6Chrome Web Store
52Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Automatic Affiliate Redirect on Every AliExpress Item Page

Opening an AliExpress item or cart page redirects your tab through Ali Hunter's own affiliate link at s.click.aliexpress.com, no click needed.

Observed on two unrelated pages.

Any existing affiliate parameter is stripped first.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress item or cart page.

No click on the extension's icon or popup is required.

The extension did this

Ali Hunter redirects your browser tab through its own affiliate link before returning you to the same page.

The redirect fires as soon as the tab starts loading a matching AliExpress URL.

What the redirect sends
  • The AliExpress page you're viewing
    https://www.aliexpress.com/item/1005006109611321.html

    The exact item or cart page you navigated to, passed as the redirect target.

  • Affiliate ID
    _DcyQxnD

    A fixed value built into the extension that attributes any resulting AliExpress purchase to Ali Hunter's affiliate account.

Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DcyQxnD&dl_target_url=https://www.aliexpress.com/item/1005006109611321.html

302 redirect back to the original item page, now carrying aff_fsk=_DcyQxnD and a freshly issued aff_trace_key tied to that ID

The code that does this

Both navigation-listener handlers in background.js, the extension ships this code unminified.

Readable version

Handler 1 — item pages, discards the query string

// Handler 1: fires on every tab load; matches AliExpress item pages// (.com / .ru). Discards the entire existing query string before// rebuilding the redirect target.chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, activeQueryCb) {  if (changeInfo.status !== "loading") return;  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {    const activeTab = tabs[0];    const tabId2 = activeTab.id;    const currentUrl = activeTab.url;    // Everything after "?" in the current URL is dropped here.    const redirectUrl =      "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DcyQxnD&dl_target_url=" +      activeTab.url.split("?")[0];    const isItemPage =      currentUrl.match("aliexpress.com/item/") || currentUrl.match("aliexpress.ru/item/");    const alreadyTagged = currentUrl.indexOf("_DcyQxnD") !== -1;    if (isItemPage && !alreadyTagged) {      chrome.tabs.update(tabId2, { url: redirectUrl });    }  });});

Handler 2 — item/cart pages, keeps the full URL

// Handler 2: same pattern, covering .us item pages and both .com/.ru// cart pages. Keeps the full URL (including query string) this time.chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) {  if (changeInfo.status !== "loading") return;  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {    const activeTab = tabs[0];    const activeTabId = activeTab.id;    const currentUrl = activeTab.url;    const redirectUrl =      "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DcyQxnD&dl_target_url=" +      currentUrl;    const isMatchingPage =      currentUrl.match("aliexpress.us/item/") ||      currentUrl.match("aliexpress.com/shopcart/") ||      currentUrl.match("aliexpress.ru/shopcart/");    if (isMatchingPage && currentUrl.indexOf("_DcyQxnD") === -1) {      chrome.tabs.update(activeTabId, { url: redirectUrl });    }  });});
Where the redirect goes
    • s.click.aliexpress.com

    AliExpress's own affiliate click-tracking/deep-link redirector, run by Alibaba. Receives the current page URL and logs the click against the extension's hardcoded affiliate ID.

AliExpress Product URLs Sent to Two Undisclosed Third Parties

Ali Hunter sends each AliExpress item page's URL to field-garnet-duckling.glitch.me, blocking the page till it replies, and to fastytb.com.

A searchLink reply would redirect the tab; test reply was empty, confirming exposure, not redirect.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress item page whose URL doesn't already contain an aff_fcid parameter.

The extension did this

The extension sends the exact page URL to field-garnet-duckling.glitch.me and waits for a reply before letting the page continue loading.

If the reply names a searchLink, your tab is navigated there.

What the request sends
  • Product page URL
    https://www.aliexpress.com/item/1005006109611321.html

    The exact item URL you navigated to, passed as the link query parameter.

Captured request
GEThttps://field-garnet-duckling.glitch.me/search-link?link=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109611321.html

308 redirect to https://fastytb.com/search-link?link=<same encoded URL>, which answered 200 with a JSON body of {} for this test product

The code that does this

The trigger and the request function, from content.js, the extension ships this code unminified.

Readable version

Top-level trigger and URL gate

// Runs once, at content-script load time, on every page.if (isAliExpressURL(window.location.href)) {  // Blocks the page (synchronous XHR below) until the third party responds.  let searchLink = fetchSearchLink(window.location.href);  if (searchLink) {    // Only reached if the response carries a searchLink value.    window.location.href = searchLink;  }}// Gate: only AliExpress item pages that do not already carry an// "aff_fcid" query parameter.function isAliExpressURL(url) {  return /aliexpress\.[a-z.]{2,}\/item\/(?!.*[\?&]aff_fcid)/.test(url);}

The blocking request function

// Sends the current AliExpress product URL to a third-party endpoint// and returns whatever redirect target it replies with.function fetchSearchLink(link) {  const xhr = new XMLHttpRequest();  xhr.open(    "GET",    `https://field-garnet-duckling.glitch.me/search-link?link=${encodeURIComponent(link)}`,    false // synchronous: blocks the page's main thread until the reply arrives  );  xhr.send();  if (xhr.status === 200) {    try {      const data = JSON.parse(xhr.responseText);      if (data && data.searchLink) {        return data.searchLink; // caller navigates the tab here      } else {        console.log("No Search link found in the response");      }    } catch (error) {      console.log("Error parsing response:", error);    }  } else {    console.log("Network response was not ok");  }}
Where the product URL goes
    • field-garnet-duckling.glitch.me

    First destination for every matching AliExpress product URL. A Glitch-hosted app, not disclosed in the extension's listing or permissions.

    • fastytb.com

    Receives the same product URL after the Glitch endpoint responds with a 308 redirect to this domain. Not disclosed in the extension's listing.

What it can do

Permissions this extension asks for, as declared in version 3.1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Watch every request your browser makes

    webRequest

  • Start, monitor and manage your downloads

    downloads

Where it sends data

Destinations our analysis observed Ali Hunter - AliExpress Dropship contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Ali Hunter - AliExpress Dropship sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

  • field-garnet-duckling.glitch.me

    Ali Hunter - AliExpress Dropship sends data to field-garnet-duckling.glitch.me. No other extension we have analysed sends data here.

Updated 30 September 2026akehmgbbgjcgdkdcmlccmcighbijpeee