Is Ali Invoice safe?

Medium risk

Ali Invoice can disable selected installed extensions based on a remote compatibility list.

Ali Invoice contacts app.aliinvoice.com to retrieve compatibility and navigation-rule configuration, then compares the compatibility list with the user's installed extensions. For two hardcoded extension IDs, it automatically disables the matching extension if it is enabled; it also reroutes some AliExpress item or store clicks through alitems.link affiliate tracking once per day.

Dropshipping Storev0.8.3.6Chrome Web Store
47Risk
Who publishes it

MEDIA 019 - 4 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Dropshipping Store
Declared legal entity
MEDIA 019
Registered address
JNA 1a, Negotin 19300, Serbia, Europe
Registered contact
Ivan Matic
Website
www.dropshipping.store/ali-invoice-instructions

Same store account

4 other listings published from this account, 30k+ users between them. 3 of them carry a finding.

Ali Invoice FREE20k+MediumSearch AliExpress by Image and Find Similar Products7k+MediumDark Mode for AliExpress & Alibaba2k+MediumGFC Invoice970Low

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

alitems.link
Also called by 2 other listings, including Ali Insider- AliExpress Product Research Tool

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress item/store clicks route through alitems.link affiliate tracking

When you click AliExpress item or store links, Ali Invoice can block the click and route it through alitems.link tracking once per day, sending the original URL as an encoded parameter to alitems.link/a/ before opening the redirect.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You click an AliExpress item or store link.

The extension did this

Ali Invoice intercepts the click, encodes the original destination URL, and opens an alitems.link affiliate-tracking URL.

Captured request
GEThttps://alitems.link/a/
Fields in the request
  • AliExpress destination URL
    https://www.aliexpress.com/item/1005001234567890.html (illustrative)

    Identifies the item or store page you tried to open so it can be forwarded through the affiliate-tracking endpoint.

What it can do

Permissions this extension asks for, as declared in version 0.8.3.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/*

  • Read and change your data on aliexpress.ru

    *://*.aliexpress.ru/*

  • Read and change your data on aliexpress.us

    *://*.aliexpress.us/*

  • Read and change your data on dropshipping.store

    *://*.dropshipping.store/*

  • Read and change your data on aliinvoice.com

    *://*.aliinvoice.com/*

  • Read and change your data on alicdn.com

    *://*.alicdn.com/*

  • Read and change your data on aliexpress-media.com

    *://*.aliexpress-media.com/*

  • Read and change your data on mmstat.com

    *://*.mmstat.com/*

  • Read and change your data on taobao.com

    *://*.taobao.com/*

  • Read and change your data on go-impulse.net

    *://*.go-impulse.net/*

  • Read and change your data on go-mpulse.net

    *://*.go-mpulse.net/*

  • Read and change your data on facebook.net

    *://*.facebook.net/*

  • Read and change your data on criteo.com

    *://*.criteo.com/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

  • Show you desktop notifications

    notifications

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

  • Keep your screen or computer awake

    power

  • See, disable and uninstall your other extensions, including your security ones

    management

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Ali Invoice contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • alitems.link

    Ali Invoice sends data to alitems.link. 4 other extensions we have analysed send data here.

  • app.aliinvoice.com

    Ali Invoice sends data to app.aliinvoice.com. One other extension we have analysed sends data here.

Updated 30 September 2026iddjifkhlboklmognibdadieodidkhcm