Is Ali Insider- AliExpress Product Research Tool safe?

Medium risk

Ali Insider silently redirects AliExpress product pages through affiliate URLs and sends browsing data to its own servers.

When you visit an AliExpress product page, the extension intercepts the navigation and replaces it with an affiliate URL at alitems.co or alitems.link, earning commissions without your knowledge. It also collects product research data — product IDs, estimated daily sales, and revenue figures — and uploads batches of this data to aliinsider.herokuapp.com tied to a persistent per-device identifier. The redirect rate and affiliate destination are controlled by a remote configuration server, allowing the operator to change behaviour without updating the extension.

aliinsider.appv4.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

AliExpress Product Page Visits Redirected Through an Affiliate Link

We observed this extension redirect a live tab from an AliExpress /item page to alitems.co, which sets an admitad.com cookie then returns with affiliate parameters.

A config weight sets frequency; the value fired on nearly all loads.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open an AliExpress product page.

The extension's background script listens for every tab navigation whose URL contains '/item'.

The extension did this

The extension replaces the tab's destination with an affiliate redirect link before you finish reading the page.

chrome.tabs.update() sends the tab to alitems.co (or alitems.link), which redirects back to the same product page carrying affiliate tracking parameters.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109519868.html
302 redirect. The response set a Set-Cookie for admitad.com (an affiliate attribution cookie) and sent the browser back to the original AliExpress product page URL, now carrying af=1320704, utm_source=admitad and utm_medium=cpa query parameters.
03EvidenceTEMPORAL PATTERN
When this fires
Every 12 hours

Once a redirect fires for a product page, the extension won't redirect that browser again for 12 hours. If you return to a product page whose URL already carries an affiliate tracking parameter, the cooldown before the next redirect drops to 12 minutes instead.

04EvidenceCODE COMPARE
The code that does this

The tab-navigation listener that redirects AliExpress product pages

What it actually does
chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {
  chrome.storage.local.get(null, (stored) => {
    const nowMs = Date.now();

    // First run: seed the 12h cooldown timer.
    if (!stored.linkDate) {
      chrome.storage.local.set({ linkDate: nowMs });
    }

    const url = tab.url || "";
    const isProductPage =
      url.includes("/item") &&
      !url.includes("1320704") &&   // excluded product ID (own affiliate landing page)
      !url.includes("1896075");     // excluded product ID (own affiliate landing page)

    if (!isProductPage) return;

    const productId = url.slice(url.lastIndexOf("/") + 1, url.lastIndexOf(".html"));
    const weight = stored.affPerc ? parseFloat(stored.affPerc) : -0.5; // remote-controlled, config default -0.5

    // Weighted coin-flip: with weight=-0.5, Math.random()-(-0.5) is always > 0.5,
    // so the alitems.co branch is taken on effectively every qualifying navigation.
    const redirectUrl = (Math.random() - weight > 0.5)
      ? `https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=${encodeURIComponent(`https://www.aliexpress.com/item/${productId}.html`)}`
      : `https://alitems.link/a/?r=ins&s=SUBID&s1=SUBID1&s2=SUBID2&s3=SUBID3&s4=SUBID4&u=${encodeURIComponent(`https://www.aliexpress.com/item/${productId}.html`)}`;

    if (!stored.linkDate) return;

    if (nowMs - parseFloat(stored.linkDate) > 43_200_000) {
      // 12h cooldown elapsed: redirect and reset both timers.
      chrome.storage.local.set({ linkDate: nowMs, linkDateRes: nowMs });
      chrome.tabs.update(tabId, { url: redirectUrl });
    } else if (url.includes("aff_trace_key") || stored.linkDateOther) {
      // Returning with an existing affiliate parameter: shorter 12min cooldown.
      if (!stored.linkDateRes || nowMs - parseFloat(stored.linkDateRes) > 720_000) {
        chrome.storage.local.set({ linkDateRes: nowMs });
        chrome.tabs.update(tabId, { url: redirectUrl });
      }
    }
  });
});
05EvidenceTHIRD PARTY LIST
Hosts involved in the affiliate redirect
  • alitems.co

    Primary affiliate redirect destination for AliExpress /item navigations; carries a fixed tracking ID and subid=pr. Responded with a 302 and admitad.com Set-Cookie in DA.

  • alitems.link

    Alternate affiliate redirect destination used on the other branch of the weighted coin-flip.

  • admitad.com

    Affiliate network that receives the attribution cookie set by the alitems.co redirect and pays out on resulting AliExpress purchases.

06EvidenceARTIFACT
Reproduce it yourself

Fetches the same alitems.co affiliate URL the extension sends your tab to and shows the redirect response, so you can see the affiliate attribution cookie and the tracking parameters appended on return, without running the extension.

Requirescurl
check-alitems-redirect.sh · sh
#!/usr/bin/env sh
# Reproduces the redirect the extension's chrome.tabs.update() call sends your
# tab to when you open an AliExpress product page.
set -e
URL="https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109519868.html"
echo "GET $URL"
curl -sS -D - -o /dev/null "$URL"
# Look for:
#  - a 30x status line
#  - Location: header pointing back to aliexpress.com/item/... with
#    af=, utm_source=admitad and utm_medium=cpa appended
#  - Set-Cookie: header for admitad.com (the affiliate attribution cookie)
How to run it
  1. 1
    Save the script.
  2. 2
    Run `sh check-alitems-redirect.sh`.
  3. 3
    Read the Location and Set-Cookie headers in the response.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Install-time remote config sets affiliate redirect rate and Shopify promo link

On install day, this extension fetches a config file from aliinsider.herokuapp.com controlling AliExpress behavior: a weight biases whether navigations redirect through alitems.co, plus a Shopify promo button's text/link, all remote-set.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension.

The install event fires once, the first time the extension is added.

The extension did this

The extension downloads a settings file from aliinsider.herokuapp.com and saves it locally.

The saved settings then decide how often AliExpress product links get redirected through an affiliate link and where an injected Shopify button points.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://aliinsider.herokuapp.com/api/exchangeRateAi
Observed during dynamic analysis to return HTTP 200 with a JSON body carrying affPerc, shopifyText, shopifyAfLink, np, npc, timeToCheck and an exchangeRateList table. This was the only request to this host during the run, and it fired during the install phase.
03EvidenceSTORAGE DUMP
What's stored on your device

affPerc weights the redirect coin-flip; shopifyText labels the button; shopifyAfLink is its link. All set by the remote config.

Locationchrome.storage.local (written by the install handler)
Contents (JSON)
{
  "np": 0,
  "npc": "",
  "affPerc": -0.5,
  "shopifyText": "Shopify <b>$1/month</b>!",
  "timeToCheck": 48,
  "shopifyAfLink": "https://shopify.pxf.io/aliinsiderpromo1"
}
04EvidenceCODE COMPARE
The code that does this

Install handler downloads the config and stores affPerc / shopifyText / shopifyAfLink

What it actually does
Install fetch + store (readable)scripts/background.js
fetch("https://aliinsider.herokuapp.com/api/exchangeRateAi")
  .then(res => res.json())
  .then(cfg => {
    if (cfg.rates) {
      let rates       = cfg.rates;
      let affPerc     = cfg.affPerc      || -0.5;                                   // remote-controlled redirect weight
      let shopifyText = cfg.shopifyText  || "Shopify <b>$1/month</b>!";             // injected button label
      let shopifyLink = cfg.shopifyAfLink|| "https://shopify.pxf.io/aliinsiderpromo1"; // injected button destination
      let np          = cfg.np  || 0;
      let npc         = cfg.npc || "";
      let timeToCheck = cfg.timeToCheck || 48;
      chrome.storage.local.set({
        exchangeRateList: rates,
        affPerc, shopifyText, shopifyAfLink: shopifyLink,
        np: 0, npNew: np, npc, npClosed: np > 0 ? false : true,
        timeToCheck
      });
    }
  });
How affPerc decides the redirect destination (tabs.onUpdated handler)scripts/background.js
// On AliExpress /item navigations:
let weight = storage.affPerc ? parseFloat(storage.affPerc) : -0.5;
if (Math.random() - weight > 0.5)
  redirectUrl = "https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=" + encodeURIComponent(itemUrl);
else
  redirectUrl = "https://alitems.link/a/?r=ins&...&u=" + encodeURIComponent(itemUrl);
// With the default affPerc=-0.5, Math.random()-(-0.5) is always > 0.5,
// so the alitems.co affiliate branch is taken for every item navigation.
shopifyAfLink sets the injected button destination (searchPage.js)scripts/content/searchPage.js
let text = cfg.shopifyText || "Shopify <b>$1/month</b>!";
let link = cfg.shopifyAfLink || "https://shopify.pxf.io/aliinsiderpromo1";
// builds a #shopify44Button span with `text`, appended into the AliExpress
// search sort bar; clicking it opens `link`.
05EvidenceTHIRD PARTY LIST
Hosts involved in the config + redirect behavior
  • aliinsider.herokuapp.com

    Operator-controlled config endpoint fetched on install; the response sets the affiliate redirect weight (affPerc) and the injected Shopify button's text and link.

  • alitems.co

    Affiliate redirect destination for AliExpress /item navigations; carries a fixed publisher tracking ID and subid=pr.

  • alitems.link

    Alternate affiliate redirect destination used on the other branch of the coin-flip.

  • shopify.pxf.io

    Destination of the injected Shopify promo button (Impact/PartnerStack affiliate link); set by shopifyAfLink in the config.

06EvidenceARTIFACT
Reproduce it yourself

Fetches the same install-time config endpoint the extension calls and prints the fields that control the affiliate redirect weight and the injected Shopify button, so you can see what values the operator is currently serving.

Requirescurljq (optional, for pretty output)
check-aliinsider-config.sh · sh
#!/usr/bin/env sh
# Reproduces the extension's install-time config fetch and shows the
# operator-controlled fields that drive its on-AliExpress behavior.
set -e
URL="https://aliinsider.herokuapp.com/api/exchangeRateAi"
echo "GET $URL"
curl -fsS "$URL" \
  | (command -v jq >/dev/null 2>&1 \
      && jq '{affPerc, shopifyText, shopifyAfLink, np, npc, timeToCheck}' \
      || cat)
# affPerc      -> tips Math.random()-affPerc > 0.5 toward the alitems.co
#                 affiliate redirect (affPerc=-0.5 redirects every item page).
# shopifyAfLink-> destination of the injected #shopify44Button on AliExpress
#                 search pages.
# shopifyText  -> label shown on that button.
How to run it
  1. 1
    Save the script.
  2. 2
    Run `sh check-aliinsider-config.sh`.
  3. 3
    Read affPerc (closer to or below -0.5 = more redirects) and shopifyAfLink (current promo destination).

Data recipients

alitems.coalitems.linkaliinsider.herokuapp.com
Updated 17 September 2026cbcoaginjmpgjalcbfmlkpjkeldoaeio