Is Ali Hunter - Aliexpress Product Tracker safe?

Medium risk

Ali Hunter rewrites AliExpress product and cart visits through affiliate links.

When you open AliExpress product or cart pages, the extension redirects the active tab through an AliExpress affiliate deep link that includes the page URL. It also intercepts clicks on AliExpress item and store links and opens a background affiliate URL to eshopwell.xyz with the clicked URL attached.

Hunt_Sv5.3.9Chrome Web Store
52Risk
Who publishes it

Hunt_S - 3 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Hunt_S

Same store account

3 other listings published from this account, 16k+ users between them. 2 of them carry a finding.

Aliexpress Free invoice - AliInvoice™️9k+MediumAli Hunter - Aliexpress Dropshipping Center4k+MediumAli Helper - AliExpress Product Research Tool3k+Medium

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

eshopwell.xyz
Also called by 3 other listings, including AliImage Search, alibill-%E2%80%93-aliexpress-invo
api-dbh1-alitools.com
Also called by 6 other listings, including AliImage Search, Ali Quick - AliExpress Dropship Tool, Zopi AI Extension - AliExpress, Temu & Amazon Dropship

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress page loads rewritten through s.click.aliexpress.com affiliate link

Opening an AliExpress product or cart page briefly redirects the tab through the extension's own s.click.aliexpress.com affiliate link before returning you to that page, attaching its hardcoded affiliate code (aff_short_key=_DmvnJJD).

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open or land on an AliExpress product or cart page (aliexpress.com, .ru, or .us item pages, or a shopcart page).

The extension did this

The extension's background listener detects the page load and briefly redirects the tab through its own s.click.aliexpress.com affiliate link before returning you to the same page.

Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DmvnJJD&dl_target_url=https://www.aliexpress.com/item/1005005869583555.html

302 redirect back to the original AliExpress item page, now carrying aff_short_key=_DmvnJJD and sk=_DmvnJJD in the URL.

Fields in the redirect
  • Current AliExpress page URL
    https://www.aliexpress.com/item/1005005869583555.html

    Shows which AliExpress item or cart page you had open; the extension attaches it to the redirect as the destination to return to.

  • Extension's affiliate code
    aff_short_key=_DmvnJJD

    A hardcoded affiliate identifier attached to every matching AliExpress page you view, crediting the extension's account for the visit.

The code that does this

Listener rewriting AliExpress navigations; a similar one covers aliexpress.us/item and *.shopcart.

Readable version
chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {    if (changeInfo.status !== "loading") return;    chrome.tabs.query({ active: true, currentWindow: true }, function(tabs) {        var activeTab = tabs[0];        var activeTabId = activeTab.id;        var activeUrl = activeTab.url;        var affiliateUrl = "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DmvnJJD&dl_target_url=" + activeTab.url.split("?")[0];        var isAliExpressItemPage = activeUrl.match("aliexpress.com/item/") || activeUrl.match("aliexpress.ru/item/");        var alreadyRedirected = activeUrl.indexOf("_DmvnJJD") !== -1;        if (isAliExpressItemPage && !alreadyRedirected) {            chrome.tabs.update(activeTabId, { url: affiliateUrl });        }    });});

AliExpress item and store clicks open eshopwell.xyz affiliate URL

When you click an AliExpress item or store link, the extension intercepts the click and opens an eshopwell.xyz CPA affiliate URL in an inactive tab.

The URL you clicked is forwarded as a parameter to that endpoint.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

The user clicks an AliExpress item or store link.

The extension did this

The extension intercepts the click and opens an eshopwell.xyz CPA affiliate URL with the clicked URL attached.

Captured request
GETeshopwell.xyz/cpa
Fields in the request
  • Clicked AliExpress URL
    https://www.aliexpress.com/item/1005001234567890.html (illustrative)

    Shows which AliExpress item or store page the user tried to open.

What it can do

Permissions this extension asks for, as declared in version 5.3.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Watch every request your browser makes

    webRequest

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Ali Hunter - Aliexpress Product Tracker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Ali Hunter - Aliexpress Product Tracker sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

  • eshopwell.xyz

    Ali Hunter - Aliexpress Product Tracker sends data to eshopwell.xyz. 2 other extensions we have analysed send data here.

Updated 30 September 2026idejooljfooepkgbanfbamleigpfdmbk