Is Ali Insider- AliExpress Product Research Tool safe?
Ali Insider silently redirects AliExpress product pages through affiliate URLs and sends browsing data to its own servers.
When you visit an AliExpress product page, the extension intercepts the navigation and replaces it with an affiliate URL at alitems.co or alitems.link, earning commissions without your knowledge. It also collects product research data — product IDs, estimated daily sales, and revenue figures — and uploads batches of this data to aliinsider.herokuapp.com tied to a persistent per-device identifier. The redirect rate and affiliate destination are controlled by a remote configuration server, allowing the operator to change behaviour without updating the extension.
Who publishes itElunit GROUP - no other listings under this identity, 4 shared hostnames
Elunit GROUP - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress Product Page Visits Redirected Through an Affiliate Link
We observed this extension redirect a live tab from an AliExpress /item page to alitems.co, which sets an admitad.com cookie then returns with affiliate parameters.
A config weight sets frequency; the value fired on nearly all loads.
What actually happens
You open an AliExpress product page.
The extension's background script listens for every tab navigation whose URL contains '/item'.
The extension replaces the tab's destination with an affiliate redirect link before you finish reading the page.
chrome.tabs.update() sends the tab to alitems.co (or alitems.link), which redirects back to the same product page carrying affiliate tracking parameters.
Captured request
302 redirect. The response set a Set-Cookie for admitad.com (an affiliate attribution cookie) and sent the browser back to the original AliExpress product page URL, now carrying af=1320704, utm_source=admitad and utm_medium=cpa query parameters.
When this fires
Every 12 hours
Once a redirect fires for a product page, the extension won't redirect that browser again for 12 hours. If you return to a product page whose URL already carries an affiliate tracking parameter, the cooldown before the next redirect drops to 12 minutes instead.
The code that does this
The tab-navigation listener that redirects AliExpress product pages
chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => { chrome.storage.local.get(null, (stored) => { const nowMs = Date.now(); // First run: seed the 12h cooldown timer. if (!stored.linkDate) { chrome.storage.local.set({ linkDate: nowMs }); } const url = tab.url || ""; const isProductPage = url.includes("/item") && !url.includes("1320704") && // excluded product ID (own affiliate landing page) !url.includes("1896075"); // excluded product ID (own affiliate landing page) if (!isProductPage) return; const productId = url.slice(url.lastIndexOf("/") + 1, url.lastIndexOf(".html")); const weight = stored.affPerc ? parseFloat(stored.affPerc) : -0.5; // remote-controlled, config default -0.5 // Weighted coin-flip: with weight=-0.5, Math.random()-(-0.5) is always > 0.5, // so the alitems.co branch is taken on effectively every qualifying navigation. const redirectUrl = (Math.random() - weight > 0.5) ? `https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=${encodeURIComponent(`https://www.aliexpress.com/item/${productId}.html`)}` : `https://alitems.link/a/?r=ins&s=SUBID&s1=SUBID1&s2=SUBID2&s3=SUBID3&s4=SUBID4&u=${encodeURIComponent(`https://www.aliexpress.com/item/${productId}.html`)}`; if (!stored.linkDate) return; if (nowMs - parseFloat(stored.linkDate) > 43_200_000) { // 12h cooldown elapsed: redirect and reset both timers. chrome.storage.local.set({ linkDate: nowMs, linkDateRes: nowMs }); chrome.tabs.update(tabId, { url: redirectUrl }); } else if (url.includes("aff_trace_key") || stored.linkDateOther) { // Returning with an existing affiliate parameter: shorter 12min cooldown. if (!stored.linkDateRes || nowMs - parseFloat(stored.linkDateRes) > 720_000) { chrome.storage.local.set({ linkDateRes: nowMs }); chrome.tabs.update(tabId, { url: redirectUrl }); } } });});Hosts involved in the affiliate redirect
- alitems.co
Primary affiliate redirect destination for AliExpress /item navigations; carries a fixed tracking ID and subid=pr. Responded with a 302 and admitad.com Set-Cookie in DA.
- alitems.link
Alternate affiliate redirect destination used on the other branch of the weighted coin-flip.
- admitad.com
Affiliate network that receives the attribution cookie set by the alitems.co redirect and pays out on resulting AliExpress purchases.
Reproduce it yourself
Fetches the same alitems.co affiliate URL the extension sends your tab to and shows the redirect response, so you can see the affiliate attribution cookie and the tracking parameters appended on return, without running the extension.
- curl
#!/usr/bin/env sh# Reproduces the redirect the extension's chrome.tabs.update() call sends your# tab to when you open an AliExpress product page.set -eURL="https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109519868.html"echo "GET $URL"curl -sS -D - -o /dev/null "$URL"# Look for:# - a 30x status line# - Location: header pointing back to aliexpress.com/item/... with# af=, utm_source=admitad and utm_medium=cpa appended# - Set-Cookie: header for admitad.com (the affiliate attribution cookie)- 1Save the script.
- 2Run
sh check-alitems-redirect.sh. - 3Read the Location and Set-Cookie headers in the response.
Install-time remote config sets affiliate redirect rate and Shopify promo link
On install day, this extension fetches a config file from aliinsider.herokuapp.com controlling AliExpress behavior: a weight biases whether navigations redirect through alitems.co, plus a Shopify promo button's text/link, all remote-set.
What actually happens
You install the extension.
The install event fires once, the first time the extension is added.
The extension downloads a settings file from aliinsider.herokuapp.com and saves it locally.
The saved settings then decide how often AliExpress product links get redirected through an affiliate link and where an injected Shopify button points.
Captured request
Observed during dynamic analysis to return HTTP 200 with a JSON body carrying affPerc, shopifyText, shopifyAfLink, np, npc, timeToCheck and an exchangeRateList table. This was the only request to this host during the run, and it fired during the install phase.
What's stored on your device
affPerc weights the redirect coin-flip; shopifyText labels the button; shopifyAfLink is its link. All set by the remote config.
- Location
- chrome.storage.local (written by the install handler)
{ "np": 0, "npc": "", "affPerc": -0.5, "shopifyText": "Shopify <b>$1/month</b>!", "timeToCheck": 48, "shopifyAfLink": "https://shopify.pxf.io/aliinsiderpromo1"}The code that does this
Install handler downloads the config and stores affPerc / shopifyText / shopifyAfLink
Install fetch + store (readable)
scripts/background.jsfetch("https://aliinsider.herokuapp.com/api/exchangeRateAi") .then(res => res.json()) .then(cfg => { if (cfg.rates) { let rates = cfg.rates; let affPerc = cfg.affPerc || -0.5; // remote-controlled redirect weight let shopifyText = cfg.shopifyText || "Shopify <b>$1/month</b>!"; // injected button label let shopifyLink = cfg.shopifyAfLink|| "https://shopify.pxf.io/aliinsiderpromo1"; // injected button destination let np = cfg.np || 0; let npc = cfg.npc || ""; let timeToCheck = cfg.timeToCheck || 48; chrome.storage.local.set({ exchangeRateList: rates, affPerc, shopifyText, shopifyAfLink: shopifyLink, np: 0, npNew: np, npc, npClosed: np > 0 ? false : true, timeToCheck }); } });How affPerc decides the redirect destination (tabs.onUpdated handler)
scripts/background.js// On AliExpress /item navigations:let weight = storage.affPerc ? parseFloat(storage.affPerc) : -0.5;if (Math.random() - weight > 0.5) redirectUrl = "https://alitems.co/g/1e8d1144941ec0117e2316525dc3e8/?subid=pr&ulp=" + encodeURIComponent(itemUrl);else redirectUrl = "https://alitems.link/a/?r=ins&...&u=" + encodeURIComponent(itemUrl);// With the default affPerc=-0.5, Math.random()-(-0.5) is always > 0.5,// so the alitems.co affiliate branch is taken for every item navigation.shopifyAfLink sets the injected button destination (searchPage.js)
scripts/content/searchPage.jslet text = cfg.shopifyText || "Shopify <b>$1/month</b>!";let link = cfg.shopifyAfLink || "https://shopify.pxf.io/aliinsiderpromo1";// builds a #shopify44Button span with `text`, appended into the AliExpress// search sort bar; clicking it opens `link`.Hosts involved in the config + redirect behavior
- aliinsider.herokuapp.com
Operator-controlled config endpoint fetched on install; the response sets the affiliate redirect weight (affPerc) and the injected Shopify button's text and link.
- alitems.co
Affiliate redirect destination for AliExpress /item navigations; carries a fixed publisher tracking ID and subid=pr.
- alitems.link
Alternate affiliate redirect destination used on the other branch of the coin-flip.
- shopify.pxf.io
Destination of the injected Shopify promo button (Impact/PartnerStack affiliate link); set by shopifyAfLink in the config.
Reproduce it yourself
Fetches the same install-time config endpoint the extension calls and prints the fields that control the affiliate redirect weight and the injected Shopify button, so you can see what values the operator is currently serving.
- curl
- jq (optional, for pretty output)
#!/usr/bin/env sh# Reproduces the extension's install-time config fetch and shows the# operator-controlled fields that drive its on-AliExpress behavior.set -eURL="https://aliinsider.herokuapp.com/api/exchangeRateAi"echo "GET $URL"curl -fsS "$URL" \ | (command -v jq >/dev/null 2>&1 \ && jq '{affPerc, shopifyText, shopifyAfLink, np, npc, timeToCheck}' \ || cat)# affPerc -> tips Math.random()-affPerc > 0.5 toward the alitems.co# affiliate redirect (affPerc=-0.5 redirects every item page).# shopifyAfLink-> destination of the injected #shopify44Button on AliExpress# search pages.# shopifyText -> label shown on that button.- 1Save the script.
- 2Run
sh check-aliinsider-config.sh. - 3Read affPerc (closer to or below -0.5 = more redirects) and shopifyAfLink (current promo destination).
What it can do
Permissions this extension asks for, as declared in version 4.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on aliexpress.com
https://*.aliexpress.com/*
Read and change your data on alitools.io
*://*.alitools.io/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Ali Insider- AliExpress Product Research Tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- alitems.link
Ali Insider- AliExpress Product Research Tool sends data to alitems.link. 4 other extensions we have analyzed send data here.
- alitems.co
Ali Insider- AliExpress Product Research Tool sends data to alitems.co. 3 other extensions we have analyzed send data here.
- aliinsider.herokuapp.com
Ali Insider- AliExpress Product Research Tool sends data to aliinsider.herokuapp.com. No other extension we have analyzed sends data here.
