Is AliDownloader Plus | Get AliExpress images safe?

Medium risk

AliDownloader Plus redirects one AliExpress link click per day through clickwrap.xyz in a background tab.

On AliExpress product and store pages, the extension intercepts a clicked link once per day and opens it through a clickwrap.xyz affiliate redirect in an inactive tab. The redirected URL includes the AliExpress link the user clicked.

Mladen Markovicv1.6Chrome Web Store
46Risk
Who publishes it

Mladen Markovic - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Mladen Markovic

Same store account

2 other listings published from this account, 35k+ users between them. 2 of them carry a finding.

AliDownloader30k+MediumAliExpress CSV Export5k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress clicks reopen through clickwrap.xyz affiliate redirect.

Clicking an AliExpress item or store link, AliDownloader Plus can intercept that click once daily and reopen it through clickwrap.xyz with the AliExpress URL attached, sending your browsing context to that redirect service.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You click an AliExpress item or store link.

The extension did this

The extension intercepts the click once per day and opens the destination through a clickwrap.xyz affiliate redirect in an inactive tab.

Captured request
GEThttps://clickwrap.xyz/cpa?subid=adp055&link=
Fields in the request
  • AliExpress destination URL
    https://www.aliexpress.com/item/1005000000000000.html (illustrative)

    Identifies the product or store page you chose to open.

  • Shopping navigation context
    AliExpress item link click (illustrative)

    Shows that the request came from a product or store link click on AliExpress.

What it can do

Permissions this extension asks for, as declared in version 1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on alicdn.com

    *://*.alicdn.com/*

  • Read and change your data on cloud.video.taobao.com

    *://cloud.video.taobao.com/*

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/*

  • Read and change your data on alidownloader.com

    *://*.alidownloader.com/*

  • Read and change your data on aliexpress.ru

    *://*.aliexpress.ru/*

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed AliDownloader Plus | Get AliExpress images contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • clickwrap.xyz

    AliDownloader Plus | Get AliExpress images sends data to clickwrap.xyz. One other extension we have analysed sends data here.

Updated 30 September 2026dmpilgggihplnobnhaleacokpfmcnahm