Is Ali Insider- AliExpress Product Research Tool safe?

Medium risk

Ali Insider silently redirects AliExpress product pages through affiliate URLs and sends browsing data to its own servers.

When you visit an AliExpress product page, the extension intercepts the navigation and replaces it with an affiliate URL at alitems.co or alitems.link, earning commissions without your knowledge. It also collects product research data — product IDs, estimated daily sales, and revenue figures — and uploads batches of this data to aliinsider.herokuapp.com tied to a persistent per-device identifier. The redirect rate and affiliate destination are controlled by a remote configuration server, allowing the operator to change behaviour without updating the extension.

aliinsider.appv4.3Chrome Web Store
49Risk
Who publishes it

Elunit GROUP - no other listings under this identity, 4 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aliinsider.app
Declared legal entity
Elunit GROUP
Registered address
Ismeta Mujezinovica 8, Belgrade 11000, RS
Registered contact
Ivan Mazinjanin

Shared hosts - 4 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

recom-acs.aliexpress
Also called by 1 other listing: AliExpress: Search similar products
alitems.link
Also called by 5 other listings
api.alitools.io
Also called by 5 other listings, including Alitools
alitems.co
Also called by 6 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress Product Page Visits Redirected Through an Affiliate Link

MediumunwantedCWE-506Dynamic sandbox

We observed this extension redirect a live tab from an AliExpress /item page to alitems.co, which sets an admitad.com cookie then returns with affiliate parameters.

What actually happens

You did this

You open an AliExpress product page.

The extension's background script listens for every tab navigation whose URL contains '/item'.

The extension did this

The extension replaces the tab's destination with an affiliate redirect link before you finish reading the page.

chrome.tabs.update() sends the tab to alitems.co (or alitems.link), which redirects back to the same product page carrying affiliate tracking parameters.

Captured request

GEThttps://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109519868.html

302 redirect. The response set a Set-Cookie for admitad.com (an affiliate attribution cookie) and sent the browser back to the original AliExpress product page URL, now carrying af=1320704, utm_source=admitad and utm_medium=cpa query parameters.

When this fires

Every 12 hours

Once a redirect fires for a product page, the extension won't redirect that browser again for 12 hours. If you return to a product page whose URL already carries an affiliate tracking parameter, the cooldown before the next redirect drops to 12 minutes instead.

The code that does this

The tab-navigation listener that redirects AliExpress product pages

Readable version
chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {  chrome.storage.local.get(null, (stored) => {    const nowMs = Date.now();    // First run: seed the 12h cooldown timer.    if (!stored.linkDate) {      chrome.storage.local.set({ linkDate: nowMs });    }    const url = tab.url || "";    const isProductPage =      url.includes("/item") &&      !url.includes("1320704") &&   // excluded product ID (own affiliate landing page)      !url.includes("1896075");     // excluded product ID (own affiliate landing page)    if (!isProductPage) return;    const productId = url.slice(url.lastIndexOf("/") + 1, url.lastIndexOf(".html"));    const weight = stored.affPerc ? parseFloat(stored.affPerc) : -0.5; // remote-controlled, config default -0.5    // Weighted coin-flip: with weight=-0.5, Math.random()-(-0.5) is always > 0.5,    // so the alitems.co branch is taken on effectively every qualifying navigation.    const redirectUrl = (Math.random() - weight > 0.5)      ? `https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=${encodeURIComponent(`https://www.aliexpress.com/item/${productId}.html`)}`      : `https://alitems.link/a/?r=ins&s=SUBID&s1=SUBID1&s2=SUBID2&s3=SUBID3&s4=SUBID4&u=${encodeURIComponent(`https://www.aliexpress.com/item/${productId}.html`)}`;    if (!stored.linkDate) return;    if (nowMs - parseFloat(stored.linkDate) > 43_200_000) {      // 12h cooldown elapsed: redirect and reset both timers.      chrome.storage.local.set({ linkDate: nowMs, linkDateRes: nowMs });      chrome.tabs.update(tabId, { url: redirectUrl });    } else if (url.includes("aff_trace_key") || stored.linkDateOther) {      // Returning with an existing affiliate parameter: shorter 12min cooldown.      if (!stored.linkDateRes || nowMs - parseFloat(stored.linkDateRes) > 720_000) {        chrome.storage.local.set({ linkDateRes: nowMs });        chrome.tabs.update(tabId, { url: redirectUrl });      }    }  });});

Hosts involved in the affiliate redirect

    • alitems.co

    Primary affiliate redirect destination for AliExpress /item navigations; carries a fixed tracking ID and subid=pr. Responded with a 302 and admitad.com Set-Cookie in DA.

    • alitems.link

    Alternate affiliate redirect destination used on the other branch of the weighted coin-flip.

    • admitad.com

    Affiliate network that receives the attribution cookie set by the alitems.co redirect and pays out on resulting AliExpress purchases.

Reproduce it yourself

Fetches the same alitems.co affiliate URL the extension sends your tab to and shows the redirect response, so you can see the affiliate attribution cookie and the tracking parameters appended on return, without running the extension.

Requires
  • curl
check-alitems-redirect.sh · sh
#!/usr/bin/env sh# Reproduces the redirect the extension's chrome.tabs.update() call sends your# tab to when you open an AliExpress product page.set -eURL="https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109519868.html"echo "GET $URL"curl -sS -D - -o /dev/null "$URL"# Look for:#  - a 30x status line#  - Location: header pointing back to aliexpress.com/item/... with#    af=, utm_source=admitad and utm_medium=cpa appended#  - Set-Cookie: header for admitad.com (the affiliate attribution cookie)
How to run it
  1. 1Save the script.
  2. 2Run sh check-alitems-redirect.sh.
  3. 3Read the Location and Set-Cookie headers in the response.

Install-time remote config sets affiliate redirect rate and Shopify promo link

MediumunwantedCWE-829Dynamic sandbox

On install day, this extension fetches a config file from aliinsider.herokuapp.com controlling AliExpress behavior: a weight biases whether navigations redirect through alitems.co, plus a Shopify promo button's text/link, all remote-set.

What actually happens

You did this

You install the extension.

The install event fires once, the first time the extension is added.

The extension did this

The extension downloads a settings file from aliinsider.herokuapp.com and saves it locally.

The saved settings then decide how often AliExpress product links get redirected through an affiliate link and where an injected Shopify button points.

Captured request

GEThttps://aliinsider.herokuapp.com/api/exchangeRateAi

Observed during dynamic analysis to return HTTP 200 with a JSON body carrying affPerc, shopifyText, shopifyAfLink, np, npc, timeToCheck and an exchangeRateList table. This was the only request to this host during the run, and it fired during the install phase.

What's stored on your device

affPerc weights the redirect coin-flip; shopifyText labels the button; shopifyAfLink is its link. All set by the remote config.

Location
chrome.storage.local (written by the install handler)
Contents
{  "np": 0,  "npc": "",  "affPerc": -0.5,  "shopifyText": "Shopify <b>$1/month</b>!",  "timeToCheck": 48,  "shopifyAfLink": "https://shopify.pxf.io/aliinsiderpromo1"}

The code that does this

Install handler downloads the config and stores affPerc / shopifyText / shopifyAfLink

Readable version

Install fetch + store (readable)

scripts/background.js
fetch("https://aliinsider.herokuapp.com/api/exchangeRateAi")  .then(res => res.json())  .then(cfg => {    if (cfg.rates) {      let rates       = cfg.rates;      let affPerc     = cfg.affPerc      || -0.5;                                   // remote-controlled redirect weight      let shopifyText = cfg.shopifyText  || "Shopify <b>$1/month</b>!";             // injected button label      let shopifyLink = cfg.shopifyAfLink|| "https://shopify.pxf.io/aliinsiderpromo1"; // injected button destination      let np          = cfg.np  || 0;      let npc         = cfg.npc || "";      let timeToCheck = cfg.timeToCheck || 48;      chrome.storage.local.set({        exchangeRateList: rates,        affPerc, shopifyText, shopifyAfLink: shopifyLink,        np: 0, npNew: np, npc, npClosed: np > 0 ? false : true,        timeToCheck      });    }  });

How affPerc decides the redirect destination (tabs.onUpdated handler)

scripts/background.js
// On AliExpress /item navigations:let weight = storage.affPerc ? parseFloat(storage.affPerc) : -0.5;if (Math.random() - weight > 0.5)  redirectUrl = "https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=" + encodeURIComponent(itemUrl);else  redirectUrl = "https://alitems.link/a/?r=ins&...&u=" + encodeURIComponent(itemUrl);// With the default affPerc=-0.5, Math.random()-(-0.5) is always > 0.5,// so the alitems.co affiliate branch is taken for every item navigation.

shopifyAfLink sets the injected button destination (searchPage.js)

scripts/content/searchPage.js
let text = cfg.shopifyText || "Shopify <b>$1/month</b>!";let link = cfg.shopifyAfLink || "https://shopify.pxf.io/aliinsiderpromo1";// builds a #shopify44Button span with `text`, appended into the AliExpress// search sort bar; clicking it opens `link`.

Hosts involved in the config + redirect behavior

    • aliinsider.herokuapp.com

    Operator-controlled config endpoint fetched on install; the response sets the affiliate redirect weight (affPerc) and the injected Shopify button's text and link.

    • alitems.co

    Affiliate redirect destination for AliExpress /item navigations; carries a fixed publisher tracking ID and subid=pr.

    • alitems.link

    Alternate affiliate redirect destination used on the other branch of the coin-flip.

    • shopify.pxf.io

    Destination of the injected Shopify promo button (Impact/PartnerStack affiliate link); set by shopifyAfLink in the config.

Reproduce it yourself

Fetches the same install-time config endpoint the extension calls and prints the fields that control the affiliate redirect weight and the injected Shopify button, so you can see what values the operator is currently serving.

Requires
  • curl
  • jq (optional, for pretty output)
check-aliinsider-config.sh · sh
#!/usr/bin/env sh# Reproduces the extension's install-time config fetch and shows the# operator-controlled fields that drive its on-AliExpress behavior.set -eURL="https://aliinsider.herokuapp.com/api/exchangeRateAi"echo "GET $URL"curl -fsS "$URL" \  | (command -v jq >/dev/null 2>&1 \      && jq '{affPerc, shopifyText, shopifyAfLink, np, npc, timeToCheck}' \      || cat)# affPerc      -> tips Math.random()-affPerc > 0.5 toward the alitems.co#                 affiliate redirect (affPerc=-0.5 redirects every item page).# shopifyAfLink-> destination of the injected #shopify44Button on AliExpress#                 search pages.# shopifyText  -> label shown on that button.
How to run it
  1. 1Save the script.
  2. 2Run sh check-aliinsider-config.sh.
  3. 3Read affPerc (closer to or below -0.5 = more redirects) and shopifyAfLink (current promo destination).

What it can do

Permissions this extension asks for, as declared in version 4.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on aliexpress.com

    https://*.aliexpress.com/*

  • Read and change your data on alitools.io

    *://*.alitools.io/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Ali Insider- AliExpress Product Research Tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • alitems.link

    Ali Insider- AliExpress Product Research Tool sends data to alitems.link. 4 other extensions we have analyzed send data here.

  • alitems.co

    Ali Insider- AliExpress Product Research Tool sends data to alitems.co. 3 other extensions we have analyzed send data here.

  • aliinsider.herokuapp.com

    Ali Insider- AliExpress Product Research Tool sends data to aliinsider.herokuapp.com. No other extension we have analyzed sends data here.

Updated 30 September 2026cbcoaginjmpgjalcbfmlkpjkeldoaeio