Is Ali Reviews safe?
Ali Reviews is high risk. When a review-import flow needs a custom parser, Ali Reviews sends the page URL and stripped HTML to priv.kudosi.ai. The response is treated as JS, passed to the service worker, and run in the tab's MAIN world.…
Who publishes itNo other listings under this identity, 3 shared hostnames
No other listings under this identity, 3 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Ali Reviews runs server-provided page scripts
When a review-import flow needs a custom parser, Ali Reviews sends the page URL and stripped HTML to priv.kudosi.ai.
The response is treated as JS, passed to the service worker, and run in the tab's MAIN world.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You start a review-import flow that needs a page-specific parser.
The extension sends page data to priv.kudosi.ai, receives JavaScript, and asks the service worker to run it in the page context.
- Current page URLhttps://www.amazon.com/dp/B0F83SV3JX
Shows which product or review page you were using when the parser ran.
- Stripped page HTML<html><body><div id="cm_cr-review_list">Customer reviews</div></body></html> (illustrative)
Sends a copy of the page structure after script tags and many nonessential attributes are removed.
- Previous parser result{"reviews":[{"author":"Jamie","content":"Works as expected","date":"June 3, 2026"}]} (illustrative)
Can include the prior extraction result when the parser flow asks for another page of reviews.
The response is consumed as JSON containing script and script_id fields, then the script value is forwarded to the service worker.
The content script posts page data and forwards the returned script
Readable request body serializer
assets/main.tsx-BkESGGnN.js:10674-10680function Gm(e) { return JSON.stringify({ url: e.url, html: e.html, previous_result: e.previous_result })}Readable parser-script request
assets/main.tsx-BkESGGnN.js:14589-14607Gf = async (e, t) => { const r = (o = await E(e), async function(e, t) { var r; const n = o.baseUrl + "/extension/get-parse-reviews-script", i = await fetch(n, { method: "POST", headers: await (null == (r = o.injectHeaders) ? void 0 : r.call(o, {})), signal: null == t ? void 0 : t.signal, body: Gm(e) }); if (o.checkResponse) { const e = await o.checkResponse(i); if (e) throw e } return i.json() }); var o; return await r(t)}Readable MAIN-world script execution
assets/index.ts-4MUgxgxF.js:1740-1781case "INJECT_SCRIPT_TO_MAIN_WORLD": try { await chrome.scripting.executeScript({ target: { tabId: i }, world: "MAIN", func: e => { try { try { const a = new Function(e + '\nreturn typeof extractReviews === "function" ? extractReviews : null;')(), t = new Function(e + '\nreturn typeof clickNextPage === "function" ? clickNextPage : null;')(); let r = !1; return a && (window.extractReviews = a, console.log("✅ extractReviews function injected successfully into main world"), r = !0), t && (window.clickNextPage = t, console.log("✅ clickNextPage function injected successfully into main world"), r = !0), !!r || (console.warn("⚠️ No extractReviews or clickNextPage functions found in script"), !1) } catch (a) { console.error("Error executing script in main world:", a) } try { const a = document.createElement("script"); return a.textContent = e, new Promise((e => { a.onload = () => { a.remove(); const t = "function" == typeof window.extractReviews, r = "function" == typeof window.clickNextPage; t && console.log("✅ extractReviews function injected successfully into main world (script)"), r && console.log("✅ clickNextPage function injected successfully into main world (script)"), e(t || r) }, a.onerror = () => { a.remove(), console.error("Error loading inline script"), e(!1) }, document.head.appendChild(a), setTimeout((() => { const t = "function" == typeof window.extractReviews, r = "function" == typeof window.clickNextPage; (t || r) && (a.remove(), e(t || r)) }), 100) })) } catch (t) { console.warn("Script element approach failed, trying Function constructor approach:", t) } } catch (a) { return console.error("Error executing script in main world:", a), !1 } }, args: [e.script] }), t({ success: !0 }) } catch (n) { console.error("Error injecting script:", n), t({ success: !1, error: n instanceof Error ? n.message : String(n) }) } break;- priv.kudosi.ai
Receives the page URL and stripped HTML, then returns the parser script consumed by the extension.
Every AliExpress product page loads an affiliate link in a zero-size frame
Opening an AliExpress product page sends its ID to minion.alihunter.io, which returns a link loaded in a hidden iframe.
On 15 Aug 2026 the frame redirected to the page with an aff_fcid tag; AliExpress set an aeu_cid cookie expiring 2094.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open an AliExpress product page.
The extension's content script runs on every https://*.aliexpress.com/* page and matches item, store/product and i URLs.
The extension asks its own server for an affiliate link for that product and loads the link inside a frame you cannot see.
The frame is created with height=0, width=0 and opacity: 0, and is appended to the end of the page body.
200 OK, {"promotion_link":"https://s.click.aliexpress.com/e/_c3CT77eX"}
- Content-From
- *.aliexpress
- Content-Type
- application/json
{ "productId": 1005003391567749, "subid": "AR"}The content script that requests the affiliate link and loads it in a zero-size frame
Frame insertion on every matching product page
assets/main.tsx-C1feHNDl.jsimport { r as e, j as i, c as o} from "./index-D5n0ft4s.js";import { A as t} from "./helpers-CbLPSmmg.js";import { g as s} from "./affiliate-Bnls6rNO.js";import { g as n} from "./affiliate-BtdEvLxA.js";import "./_commonjsHelpers-CdNy-jbM.js";const r = () => (e.useEffect((() => { (async () => { const e = n(window.location.href); if (e) { const { promotion_link: i } = await s(e); if (i) { const e = `<iframe src="${i}" height="0" width="0" style="opacity: 0;"></iframe>`; document.body.insertAdjacentHTML("beforeend", e) } } })(), document.head.insertAdjacentHTML("beforeend", `<link href="${t}" rel="stylesheet">`) }), []), i.jsxDEV(i.Fragment, {}, void 0, !1, { fileName: "/builds/compass/alireviews/frontend/alireviews-chrome-extension/src/content-scripts/affiliate/components/Affiliate/Affiliate.tsx", lineNumber: 29, columnNumber: 10 }, void 0)), a = () => i.jsxDEV(r, {}, void 0, !1, { fileName: "/builds/compass/alireviews/frontend/alireviews-chrome-extension/src/content-scripts/affiliate/App.tsx", lineNumber: 4, columnNumber: 10 }, void 0), m = document.createElement("div");m.id = "crx-affiliate-root", window.addEventListener("load", (() => { var e; null == (e = document.body) || e.appendChild(m)})), o.createRoot(m).render(i.jsxDEV(a, {}, void 0, !1, { fileName: "/builds/compass/alireviews/frontend/alireviews-chrome-extension/src/content-scripts/affiliate/main.tsx", lineNumber: 10, columnNumber: 25}, void 0));The promotion-generate call and the redirector follower
assets/affiliate-Bnls6rNO.jsimport { $ as httpClient } from "./affiliate-BtdEvLxA.js";const generatePromotionLink = (productId) => httpClient.post( `https://minion.alihunter.io/promotion-generate?productId=${productId}&subid=AR`, { productId: productId, subid: "AR" }, { "Content-From": "*.aliexpress" } );const followRedirector = async (url) => { try { const { status, url: finalUrl } = await fetch(url); return status && finalUrl ? finalUrl : null; } catch { return null; }};export { generatePromotionLink as g, followRedirector as p };302 to https://aliexpress.com/item/1005003391567749.html?aff_fcid=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX&aff_fsk=_c3CT77eX&aff_platform=api-new-link-generate&sk=_c3CT77eX&aff_trace_key=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX&terminal_id=3da78c2035424d3dad0a1f8a27044326, then 301 to the www host, and the response carried Set-Cookie headers that placed the affiliate attribution cookies listed below on .aliexpress.com.
- Affiliate attribution cookieaeu_cid=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX; Domain=.aliexpress.com; Expires=Thu, 02-Sep-2094 19:37:38 GMT; Path=/; Secure; SameSite=None
Tells AliExpress which partner to credit for purchases. Set for the whole aliexpress.com domain, expiring in 2094, so it outlives the visit.
- Attribution tag in the page addressaff_fcid=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX
The same partner reference is added to the address of the product page you were viewing, recording credit for the visit.
- AliExpress terminal identifierterminal_id=3da78c2035424d3dad0a1f8a27044326
A per-browser identifier AliExpress carries through the redirect, tying attribution to your specific browser, not just the visit.
- Referral source markersaf_ss_a=1; af_ss_b=1; traffic_se_co=%7B%7D
Two flag cookies and a source record AliExpress writes at the same time, marking the session as arriving via a partner link.
- What your browser sent out{"productId":1005003391567749,"subid":"AR"}
The only thing sent to the extension's own server is the numeric product ID of the item you are viewing, together with a fixed partner tag.
- minion.alihunter.io
Receives the product ID of each AliExpress page opened, returns an affiliate link. Run by the publisher; cdn.alireviews.io and operate-lumen-api.socialhead.io were also contacted.
- s.click.aliexpress.com
AliExpress's own affiliate redirector. The frame's request here is what issues the attribution reference and the accompanying cookies.
- aliexpress.com
The product page you were already viewing, re-requested through the redirect so that it carries the affiliate attribution parameters.
The Chrome Web Store listing for Ali Reviews states: "Ali Reviews participates in affiliate programs of Shopify & AliExpress to enhance our services, with some links including affiliate tracking, though this has no impact on your experience or costs." The behaviour recorded here is not attached to a link you choose to click: the attribution is established by a zero-size frame that the extension appends to every AliExpress product page you open, and the resulting cookie applies to the whole aliexpress.com domain for the lifetime of the browser profile. We did not measure any effect on prices, and we make no finding about what the publisher does with the resulting commissions.
CDN config controls Amazon parsing rules
When the Amazon review import runs, Ali Reviews requests a JSON config from cdnhub.kudosi.ai.
If valid, the extension uses its regex arrays, date/country maps, and selector object instead of bundled defaults.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You start an Amazon review import.
The extension fetches parser configuration from cdnhub.kudosi.ai and applies returned parsing rules when the JSON is valid.
The request appends a cache-busting v parameter and parses the response as JSON before applying parser rules.
- Content-Type
- application/json
- Country regex patternsamazon-regex-countries: [{"pattern":"Reviewed in (?<country>.*) on","flags":""}] (illustrative)
Remote regex entries can change how the parser recognizes the country text in Amazon reviews.
- Date regex patternsamazon-regex-dates: [{"pattern":"(?<month>\\w+) (?<day>\\d+), (?<year>\\d+)","flags":""}] (illustrative)
Remote regex entries can change how review dates are recognized.
- Date and country mapsamazon-countries: {"US":"United States"} (illustrative)
Remote map values can change country and date normalization during parsing.
- Selector objectselectors: {"tags":{},"dataHook":{},"class":{},"attributes":{}} (illustrative)
Remote selectors can change which page elements are read as review text, author, date, rating, and country.
The service worker loads and applies CDN parser configuration
Readable CDN base URL
assets/helpers-BKQm52s5.js:12-14const u = "https://priv.kudosi.ai", i = "https://cdn.alireviews.io/css/aliexpress_banner_extension.css", o = "https://cdnhub.kudosi.ai/"Readable Amazon config fetch
assets/index.ts-4MUgxgxF.js:1345-1363const l = await (async () => { const e = `${G}/assets/amazon/amazon.json`; try { const a = new AbortController, t = setTimeout((() => a.abort()), 5e3), r = await fetch(e + "?v=" + (new Date).getTime(), { method: "GET", headers: { "Content-Type": "application/json" }, signal: a.signal }); if (clearTimeout(t), !r.ok) return console.warn(`[Amazon Config] CDN fetch failed with status ${r.status}, falling back to static files`), null; const n = await r.json(); return n && "object" == typeof n ? (console.info("[Amazon Config] Successfully fetched config from CDN"), n) : (console.warn("[Amazon Config] Invalid response structure, falling back to static files"), null) } catch (a) { return a instanceof Error && "AbortError" === a.name ? (console.warn("[Amazon Config] Fetch timeout, falling back to static files"), null) : a instanceof TypeError ? (console.warn("[Amazon Config] Network error, falling back to static files:", a.message), null) : a instanceof SyntaxError ? (console.warn("[Amazon Config] Invalid JSON response, falling back to static files"), null) : (console.error("[Amazon Config] Unexpected error during fetch:", a), null) }})();Readable remote parser-field mapping
assets/index.ts-4MUgxgxF.js:1374-1384if (l) { const e = (S = l)["amazon-regex-countries"] && Array.isArray(S["amazon-regex-countries"]) ? S["amazon-regex-countries"] : [], a = (e => e["amazon-regex-dates"] && Array.isArray(e["amazon-regex-dates"]) ? e["amazon-regex-dates"] : [])(l); u = e.map((e => new RegExp(e.pattern, e.flags))), m = a.map((e => new RegExp(e.pattern, e.flags))), p = (e => e["amazon-dates"] && "object" == typeof e["amazon-dates"] ? e["amazon-dates"] : {})(l), y = (e => e["amazon-countries"] && "object" == typeof e["amazon-countries"] ? e["amazon-countries"] : {})(l), h = (e => e.countries && "object" == typeof e.countries ? e.countries : {})(l); const t = (e => { if (!e.selectors || "object" != typeof e.selectors) return null; const a = e.selectors; return a.tags && a.dataHook && a.class && a.attributes ? a : null })(l); w = t ? ((e, a) => a ? K({}, e, a) : e)(E, t) : E} else u = f.countryRegexPatterns, m = f.dateRegexPatterns, p = f.dateFormats, y = f.amazonCountries, h = f.countries, w = E;- cdnhub.kudosi.ai
Serves the Amazon parser JSON used to override bundled regex, map, and selector defaults.
+1 more finding not shown