Is Alibaba Lens: Official Alibaba.com Image Search Tool for Wholesale Supply safe?
Alibaba Lens is medium risk. We observed Alibaba Lens send a GET to Alibaba's analytics host after extension interaction, carrying the current page URL, the CNA cookie identifier, event name, browser locale, extension version, and user-agent information.
Who publishes italibaba-lens - no other listings under this identity, 3 shared hostnames
alibaba-lens - no other listings under this identity, 3 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Alibaba Lens sends page URLs to Alibaba analytics
We observed Alibaba Lens send a GET to Alibaba's analytics host after extension interaction, carrying the current page URL, the CNA cookie identifier, event name, browser locale, extension version, and user-agent information.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install Alibaba Lens or use a Lens feature in the browser.
The background script calls the analytics routine on install, toolbar icon clicks, image capture, side-panel events, and context-menu searches.
The extension sends your current page URL and browser context to Alibaba analytics.
The same request includes a CNA cookie identifier and event metadata.
200 OK
- Current page URLhttps://www.example.com/
Shows the page you were viewing when the extension event occurred.
- Alibaba cookie identifierA8rZIoOGtD0CAS/2WPeBQXyP
Lets the analytics endpoint connect repeated extension events to the same browser profile.
- Event nameEXP
Shows which Lens feature or extension lifecycle event triggered the request.
- Browser localeen-US
Adds language and regional context to the browsing event.
- Extension version1.3.4
Identifies the installed Alibaba Lens release that generated the request.
- Browser user agentMozilla/5.0
Adds browser and device details that can make events easier to correlate.
The background analytics function builds the request from the active tab URL
Readable equivalent of the analytics sender
background.jsconst readActiveTabUrl = () => new Promise(resolve => { chrome.tabs.query({ active: true, currentWindow: true }, tabs => { if (tabs.length === 0) { resolve(""); return; } const tab = tabs[0]; resolve(tab.url || ""); });});const sendAnalytics = async (eventType, ...eventFields) => { const gokeyParts = []; const currentPageUrl = await readActiveTabUrl(); const browserLocale = navigator.language; const fields = [ ...eventFields, { pluginLocale: (await getPluginLocale()).replace("_", "-"), browserLocale, pluginVersion: chrome.runtime.getManifest().version, ua: navigator?.userAgent ?? "" } ]; let alreadyHasTimestamp = false; for (const fieldGroup of fields) { if (typeof fieldGroup === "object" && fieldGroup !== null) { for (const [key, value] of Object.entries(fieldGroup)) { if (key === "ts") alreadyHasTimestamp = true; if (key === "imageAddress" && value?.length > 1000) continue; gokeyParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`); } } else if (typeof fieldGroup === "string") { if (fieldGroup.includes("ts=")) alreadyHasTimestamp = true; gokeyParts.push(fieldGroup); } } const params = { cna: await readCnaCookie(), gmkey: eventType || "EXP", gokey: `${gokeyParts.join("&")}${alreadyHasTimestamp ? "" : "&ts=" + +Date.now()}`, _p_url: currentPageUrl }; fetch(`https://gj.mmstat.com/sc.search.lens?${Object.keys(params).map(key => `${encodeURIComponent(key)}=${encodeURIComponent(params[key])}`).join("&")}`, { credentials: "include" });};- gj.mmstat.com
Alibaba analytics endpoint that receives the current page URL, CNA cookie identifier, event name, locale, extension version, and browser user-agent details.