Is Ali Reviews safe?

High risk

Ali Reviews is high risk. When a review-import flow needs a custom parser, Ali Reviews sends the page URL and stripped HTML to priv.kudosi.ai. The response is treated as JS, passed to the service worker, and run in the tab's MAIN world.…

77Risk
Who publishes it

No other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

minion.alihunter.io
Also called by 2 other listings, including AliHunter
go.onecommerce.io
Also called by 3 other listings, including AliHunter
operate-lumen-api.socialhead.io
Also called by 3 other listings, including AliHunter

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ali Reviews runs server-provided page scripts

When a review-import flow needs a custom parser, Ali Reviews sends the page URL and stripped HTML to priv.kudosi.ai.

The response is treated as JS, passed to the service worker, and run in the tab's MAIN world.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You start a review-import flow that needs a page-specific parser.

The extension did this

The extension sends page data to priv.kudosi.ai, receives JavaScript, and asks the service worker to run it in the page context.

Fields posted to the parser endpoint
  • Current page URL
    https://www.amazon.com/dp/B0F83SV3JX

    Shows which product or review page you were using when the parser ran.

  • Stripped page HTML
    <html><body><div id="cm_cr-review_list">Customer reviews</div></body></html> (illustrative)

    Sends a copy of the page structure after script tags and many nonessential attributes are removed.

  • Previous parser result
    {"reviews":[{"author":"Jamie","content":"Works as expected","date":"June 3, 2026"}]} (illustrative)

    Can include the prior extraction result when the parser flow asks for another page of reviews.

Captured request
POSThttps://priv.kudosi.ai/extension/get-parse-reviews-script

The response is consumed as JSON containing script and script_id fields, then the script value is forwarded to the service worker.

The code that does this

The content script posts page data and forwards the returned script

Readable version

Readable request body serializer

assets/main.tsx-BkESGGnN.js:10674-10680
function Gm(e) {  return JSON.stringify({    url: e.url,    html: e.html,    previous_result: e.previous_result  })}

Readable parser-script request

assets/main.tsx-BkESGGnN.js:14589-14607
Gf = async (e, t) => {  const r = (o = await E(e), async function(e, t) {    var r;    const n = o.baseUrl + "/extension/get-parse-reviews-script",      i = await fetch(n, {        method: "POST",        headers: await (null == (r = o.injectHeaders) ? void 0 : r.call(o, {})),        signal: null == t ? void 0 : t.signal,        body: Gm(e)      });    if (o.checkResponse) {      const e = await o.checkResponse(i);      if (e) throw e    }    return i.json()  });  var o;  return await r(t)}

Readable MAIN-world script execution

assets/index.ts-4MUgxgxF.js:1740-1781
case "INJECT_SCRIPT_TO_MAIN_WORLD":  try {    await chrome.scripting.executeScript({      target: {        tabId: i      },      world: "MAIN",      func: e => {        try {          try {            const a = new Function(e + '\nreturn typeof extractReviews === "function" ? extractReviews : null;')(),              t = new Function(e + '\nreturn typeof clickNextPage === "function" ? clickNextPage : null;')();            let r = !1;            return a && (window.extractReviews = a, console.log("✅ extractReviews function injected successfully into main world"), r = !0), t && (window.clickNextPage = t, console.log("✅ clickNextPage function injected successfully into main world"), r = !0), !!r || (console.warn("⚠️ No extractReviews or clickNextPage functions found in script"), !1)          } catch (a) {            console.error("Error executing script in main world:", a)          }          try {            const a = document.createElement("script");            return a.textContent = e, new Promise((e => {              a.onload = () => {                a.remove();                const t = "function" == typeof window.extractReviews,                  r = "function" == typeof window.clickNextPage;                t && console.log("✅ extractReviews function injected successfully into main world (script)"), r && console.log("✅ clickNextPage function injected successfully into main world (script)"), e(t || r)              }, a.onerror = () => {                a.remove(), console.error("Error loading inline script"), e(!1)              }, document.head.appendChild(a), setTimeout((() => {                const t = "function" == typeof window.extractReviews,                  r = "function" == typeof window.clickNextPage;                (t || r) && (a.remove(), e(t || r))              }), 100)            }))          } catch (t) {            console.warn("Script element approach failed, trying Function constructor approach:", t)          }        } catch (a) {          return console.error("Error executing script in main world:", a), !1        }      },      args: [e.script]    }), t({      success: !0    })  } catch (n) {    console.error("Error injecting script:", n), t({      success: !1,      error: n instanceof Error ? n.message : String(n)    })  }  break;
External services in this flow
    • priv.kudosi.ai

    Receives the page URL and stripped HTML, then returns the parser script consumed by the extension.

Every AliExpress product page loads an affiliate link in a zero-size frame

Opening an AliExpress product page sends its ID to minion.alihunter.io, which returns a link loaded in a hidden iframe.

On 15 Aug 2026 the frame redirected to the page with an aff_fcid tag; AliExpress set an aeu_cid cookie expiring 2094.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress product page.

The extension's content script runs on every https://*.aliexpress.com/* page and matches item, store/product and i URLs.

The extension did this

The extension asks its own server for an affiliate link for that product and loads the link inside a frame you cannot see.

The frame is created with height=0, width=0 and opacity: 0, and is appended to the end of the page body.

Captured request
POSThttps://minion.alihunter.io/promotion-generate?productId=1005003391567749&subid=AR

200 OK, {"promotion_link":"https://s.click.aliexpress.com/e/_c3CT77eX"}

Headers
Content-From
*.aliexpress
Content-Type
application/json
Body
{  "productId": 1005003391567749,  "subid": "AR"}
The code that does this

The content script that requests the affiliate link and loads it in a zero-size frame

Readable version

Frame insertion on every matching product page

assets/main.tsx-C1feHNDl.js
import {  r as e,  j as i,  c as o} from "./index-D5n0ft4s.js";import {  A as t} from "./helpers-CbLPSmmg.js";import {  g as s} from "./affiliate-Bnls6rNO.js";import {  g as n} from "./affiliate-BtdEvLxA.js";import "./_commonjsHelpers-CdNy-jbM.js";const r = () => (e.useEffect((() => {    (async () => {      const e = n(window.location.href);      if (e) {        const {          promotion_link: i        } = await s(e);        if (i) {          const e = `<iframe src="${i}" height="0" width="0" style="opacity: 0;"></iframe>`;          document.body.insertAdjacentHTML("beforeend", e)        }      }    })(), document.head.insertAdjacentHTML("beforeend", `<link href="${t}" rel="stylesheet">`)  }), []), i.jsxDEV(i.Fragment, {}, void 0, !1, {    fileName: "/builds/compass/alireviews/frontend/alireviews-chrome-extension/src/content-scripts/affiliate/components/Affiliate/Affiliate.tsx",    lineNumber: 29,    columnNumber: 10  }, void 0)),  a = () => i.jsxDEV(r, {}, void 0, !1, {    fileName: "/builds/compass/alireviews/frontend/alireviews-chrome-extension/src/content-scripts/affiliate/App.tsx",    lineNumber: 4,    columnNumber: 10  }, void 0),  m = document.createElement("div");m.id = "crx-affiliate-root", window.addEventListener("load", (() => {  var e;  null == (e = document.body) || e.appendChild(m)})), o.createRoot(m).render(i.jsxDEV(a, {}, void 0, !1, {  fileName: "/builds/compass/alireviews/frontend/alireviews-chrome-extension/src/content-scripts/affiliate/main.tsx",  lineNumber: 10,  columnNumber: 25}, void 0));

The promotion-generate call and the redirector follower

assets/affiliate-Bnls6rNO.js
import { $ as httpClient } from "./affiliate-BtdEvLxA.js";const generatePromotionLink = (productId) =>  httpClient.post(    `https://minion.alihunter.io/promotion-generate?productId=${productId}&subid=AR`,    { productId: productId, subid: "AR" },    { "Content-From": "*.aliexpress" }  );const followRedirector = async (url) => {  try {    const { status, url: finalUrl } = await fetch(url);    return status && finalUrl ? finalUrl : null;  } catch {    return null;  }};export { generatePromotionLink as g, followRedirector as p };
Captured request
GEThttps://s.click.aliexpress.com/e/_c3CT77eX

302 to https://aliexpress.com/item/1005003391567749.html?aff_fcid=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX&aff_fsk=_c3CT77eX&aff_platform=api-new-link-generate&sk=_c3CT77eX&aff_trace_key=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX&terminal_id=3da78c2035424d3dad0a1f8a27044326, then 301 to the www host, and the response carried Set-Cookie headers that placed the affiliate attribution cookies listed below on .aliexpress.com.

What the redirector attached to your AliExpress session
  • Affiliate attribution cookie
    aeu_cid=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX; Domain=.aliexpress.com; Expires=Thu, 02-Sep-2094 19:37:38 GMT; Path=/; Secure; SameSite=None

    Tells AliExpress which partner to credit for purchases. Set for the whole aliexpress.com domain, expiring in 2094, so it outlives the visit.

  • Attribution tag in the page address
    aff_fcid=ad92ae14f48f42d1b3db5ed101163977-1786811011934-04269-_c3CT77eX

    The same partner reference is added to the address of the product page you were viewing, recording credit for the visit.

  • AliExpress terminal identifier
    terminal_id=3da78c2035424d3dad0a1f8a27044326

    A per-browser identifier AliExpress carries through the redirect, tying attribution to your specific browser, not just the visit.

  • Referral source markers
    af_ss_a=1; af_ss_b=1; traffic_se_co=%7B%7D

    Two flag cookies and a source record AliExpress writes at the same time, marking the session as arriving via a partner link.

  • What your browser sent out
    {"productId":1005003391567749,"subid":"AR"}

    The only thing sent to the extension's own server is the numeric product ID of the item you are viewing, together with a fixed partner tag.

Hosts involved in the chain
    • minion.alihunter.io

    Receives the product ID of each AliExpress page opened, returns an affiliate link. Run by the publisher; cdn.alireviews.io and operate-lumen-api.socialhead.io were also contacted.

    • s.click.aliexpress.com

    AliExpress's own affiliate redirector. The frame's request here is what issues the attribution reference and the accompanying cookies.

    • aliexpress.com

    The product page you were already viewing, re-requested through the redirect so that it carries the affiliate attribution parameters.

What the listing says

The Chrome Web Store listing for Ali Reviews states: "Ali Reviews participates in affiliate programs of Shopify & AliExpress to enhance our services, with some links including affiliate tracking, though this has no impact on your experience or costs." The behaviour recorded here is not attached to a link you choose to click: the attribution is established by a zero-size frame that the extension appends to every AliExpress product page you open, and the resulting cookie applies to the whole aliexpress.com domain for the lifetime of the browser profile. We did not measure any effect on prices, and we make no finding about what the publisher does with the resulting commissions.

CDN config controls Amazon parsing rules

When the Amazon review import runs, Ali Reviews requests a JSON config from cdnhub.kudosi.ai.

If valid, the extension uses its regex arrays, date/country maps, and selector object instead of bundled defaults.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You start an Amazon review import.

The extension did this

The extension fetches parser configuration from cdnhub.kudosi.ai and applies returned parsing rules when the JSON is valid.

Captured request
GEThttps://cdnhub.kudosi.ai/assets/amazon/amazon.json

The request appends a cache-busting v parameter and parses the response as JSON before applying parser rules.

Headers
Content-Type
application/json
Remote config fields consumed by the parser
  • Country regex patterns
    amazon-regex-countries: [{"pattern":"Reviewed in (?<country>.*) on","flags":""}] (illustrative)

    Remote regex entries can change how the parser recognizes the country text in Amazon reviews.

  • Date regex patterns
    amazon-regex-dates: [{"pattern":"(?<month>\\w+) (?<day>\\d+), (?<year>\\d+)","flags":""}] (illustrative)

    Remote regex entries can change how review dates are recognized.

  • Date and country maps
    amazon-countries: {"US":"United States"} (illustrative)

    Remote map values can change country and date normalization during parsing.

  • Selector object
    selectors: {"tags":{},"dataHook":{},"class":{},"attributes":{}} (illustrative)

    Remote selectors can change which page elements are read as review text, author, date, rating, and country.

The code that does this

The service worker loads and applies CDN parser configuration

Readable version

Readable CDN base URL

assets/helpers-BKQm52s5.js:12-14
const u = "https://priv.kudosi.ai",  i = "https://cdn.alireviews.io/css/aliexpress_banner_extension.css",  o = "https://cdnhub.kudosi.ai/"

Readable Amazon config fetch

assets/index.ts-4MUgxgxF.js:1345-1363
const l = await (async () => {  const e = `${G}/assets/amazon/amazon.json`;  try {    const a = new AbortController,      t = setTimeout((() => a.abort()), 5e3),      r = await fetch(e + "?v=" + (new Date).getTime(), {        method: "GET",        headers: {          "Content-Type": "application/json"        },        signal: a.signal      });    if (clearTimeout(t), !r.ok) return console.warn(`[Amazon Config] CDN fetch failed with status ${r.status}, falling back to static files`), null;    const n = await r.json();    return n && "object" == typeof n ? (console.info("[Amazon Config] Successfully fetched config from CDN"), n) : (console.warn("[Amazon Config] Invalid response structure, falling back to static files"), null)  } catch (a) {    return a instanceof Error && "AbortError" === a.name ? (console.warn("[Amazon Config] Fetch timeout, falling back to static files"), null) : a instanceof TypeError ? (console.warn("[Amazon Config] Network error, falling back to static files:", a.message), null) : a instanceof SyntaxError ? (console.warn("[Amazon Config] Invalid JSON response, falling back to static files"), null) : (console.error("[Amazon Config] Unexpected error during fetch:", a), null)  }})();

Readable remote parser-field mapping

assets/index.ts-4MUgxgxF.js:1374-1384
if (l) {  const e = (S = l)["amazon-regex-countries"] && Array.isArray(S["amazon-regex-countries"]) ? S["amazon-regex-countries"] : [],    a = (e => e["amazon-regex-dates"] && Array.isArray(e["amazon-regex-dates"]) ? e["amazon-regex-dates"] : [])(l);  u = e.map((e => new RegExp(e.pattern, e.flags))), m = a.map((e => new RegExp(e.pattern, e.flags))), p = (e => e["amazon-dates"] && "object" == typeof e["amazon-dates"] ? e["amazon-dates"] : {})(l), y = (e => e["amazon-countries"] && "object" == typeof e["amazon-countries"] ? e["amazon-countries"] : {})(l), h = (e => e.countries && "object" == typeof e.countries ? e.countries : {})(l);  const t = (e => {    if (!e.selectors || "object" != typeof e.selectors) return null;    const a = e.selectors;    return a.tags && a.dataHook && a.class && a.attributes ? a : null  })(l);  w = t ? ((e, a) => a ? K({}, e, a) : e)(E, t) : E} else u = f.countryRegexPatterns, m = f.dateRegexPatterns, p = f.dateFormats, y = f.amazonCountries, h = f.countries, w = E;
Remote host controlling parser configuration
    • cdnhub.kudosi.ai

    Serves the Amazon parser JSON used to override bundled regex, map, and selector defaults.

+1 more finding not shown

Updated 30 September 2026bbaogjaeflnjolejjcpceoapngapnbaj