Is AliDropship 2.0 safe?

Medium risk

AliDropship 2.0 sends AliExpress product data and order details to its own servers and a third-party GraphQL endpoint.

When you visit AliExpress product or category pages, the extension collects product IDs, prices, and store URLs and POSTs them to tools.alidropship.com. When orders are placed or tracked, full order details including payment dates, tracking IDs, and product objects are transmitted via GraphQL mutations to node3.ssdma.com. A content script running on all pages also accepts order automation commands over window.postMessage without validating the message origin.

AliDropshipv3.0.0.95Chrome Web Store
48Risk
Who publishes it

Sunshine Ecommerce LLC - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AliDropship
Declared legal entity
Sunshine Ecommerce LLC
Registered address
3204 Spectrum, Irvine, CA 92618, US
Registered contact
Dolgikh Ilia
Website
alidropship.com/codex/

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

patik.com
Also called by 2 other listings: Thea, Thea

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress order details sent to external GraphQL endpoint

MediumunwantedCWE-200Dynamic sandbox

AliDropship 2.0 posts order/tracking records for AliExpress orders to node3.ssdma.com/graphql: payment/shipping dates, tracking numbers, order/product IDs, order status, and tracking status.

What actually happens

You did this

You process AliExpress orders or view an AliExpress order-detail page through AliDropship 2.0.

The trigger path is tied to order workflows; a test session without a connected store did not reach it.

The extension did this

The extension prepares order and tracking details for an external GraphQL request.

The destination configured in the background code is https://node3.ssdma.com/graphql.

Order fields prepared for the GraphQL mutations

  • Payment date
    2026-07-12 14:38:05 (illustrative)

    Shows when your AliExpress order was paid.

  • Shipping date
    2026-07-13 09:22:41 (illustrative)

    Shows when the order was shipped or prepared for shipment.

  • Tracking number
    LP123456789CN (illustrative)

    Can tie the shipment record to a specific package and delivery route.

  • AliExpress order ID
    8123456789012345 (illustrative)

    Links the record to a specific AliExpress purchase processed through the extension.

  • Product ID
    1005006123456789 (illustrative)

    Identifies the product associated with the order record.

  • Order and tracking status
    completed / DELIVERED (illustrative)

    Shows whether the order completed and the current shipping state recorded by AliExpress.

Captured request

POSThttps://node3.ssdma.com/graphql

The unauthenticated dynamic test did not trigger the order workflow, so no request body or response was captured.

The code that does this

Endpoint, field mapping, and mutation calls in the shipped extension

Readable version

GraphQL endpoint and Apollo client

deobfuscated/js/background.js:30020,30125-30135
jn = "https://node3.ssdma.com/graphql";var Un = r(20689).createApolloFetch,  Wn = r(5895).createUploadLink;var Bn = new hr({  ssrMode: "undefined" != typeof window,  cache: new En,  fetchOptions: {    credentials: "include"  },  link: Wn({    uri: jn  })})

Order detail mapper

deobfuscated/js/background.js:30336-30362
function l(e) {  if (!e.statusOrder) return "";  var t = e.statusOrder;  if (t.endReason) return t.id && "FINISH" === t.orderStatus ? "completed" : "";  return ["buyer_accept_goods_timeout", "buyer_accept_goods"][e.statusOrder.endReason] ? "completed" : ""}function d(e) {  return e.map((function(e) {    var t = !!(e.trackDetals && Object.keys(e.trackDetals).length > 0 && e.trackDetals.lightList) && e.trackDetals.lightList.find((function(e) {      return e.current    }));    return {      payDate: e.payDate,      shipDate: e.shipDate,      tracking_id: e.trackingNo,      products: e.products.map((function(e) {        return {          order_id_ali: e.orderId,          productId: e.productId        }      })),      status: l(e),      trackingStatus: t ? t.code : ""    }  }))}

GraphQL mutations

deobfuscated/js/background.js:30465-30491
if (console.log("sendApp"), console.log(e, t), console.log(t.action, t), "setOrdersTIP" === t.action) return r = t.ordersDetail, i = d(r), Bn.mutate({  mutation: (0, Pn.ZP)(Yn || (Yn = An(["\n                mutation setOrdersTIP ($ordersDetail : [ordersDetailInput!]!) {\n                    setOrdersTIP(ordersDetail : $ordersDetail)\n                }\n            "]))),  variables: {    ordersDetail: i  }}).then((function(e) {  return e.data.setOrdersTIP})).catch((function(e) {  return console.error(e)}));var r, i, o, l, m, p, _, y;if ("setOrdersIdAli" === t.action) return function(e, t) {  var r = d(e);  return t = t.map((function(e) {    return delete e.success, e  })), Bn.mutate({    mutation: (0, Pn.ZP)(Sn || (Sn = An(["\n                mutation setOrdersIdAli ($products: [productsAutofillingOrderInput!], $ordersDetail : [ordersDetailInput!]!) {\n                    setOrdersIdAli(products: $products, ordersDetail : $ordersDetail)\n                }\n            "]))),    variables: {      products: qn(t),      ordersDetail: r    }  }).then((function(e) {    return e.data.UpdateProductTask  })).catch((function(e) {    return console.error(e)  }))}(t.ordersDetail, t.products);

Order-detail page trigger

deobfuscated/js/background.js:32021-32063
function n(e) {  _.isAuth(!0).then((function() {    s(mi.getLastTabID(), !1, "getOrdersDetail", e).then((function(e) {      mi.sendAllStore("setOrdersTIP", {        ordersDetail: e      })    }))  }))}function i(e) {  _.isAuth(!0).then((function() {    console.log(e);    var t = e.orderIdAli,      r = e.orderIdStore,      n = [t];    s(mi.getLastTabID(), !1, "getOrdersDetail", n).then((function(e) {      var t = [];      e.length > 0 && (t = e[0]), mi.sendAllStore("setOrderTIP", {        orderDetail: t,        orderIdStore: r      })    }))  }))}return {  init: function() {    e || (e = this, o.on("adsGoogleExtension:getTIPOrders", n), o.on("adsGoogleExtension:getTIPOrder", i), m("page_order_detail:open", (function(e, t) {      s(t.tab.id, !1, "getOrdersDetail", e.orderList).then((function(e) {        mi.sendAllStore("setOrdersTIP", {          ordersDetail: e.filter(Boolean)        })      }))    })))  },  getOrdersDetail: function(e) {    return function(e) {      var t = [];      return Array.isArray(e) && e.length > 0 ? t = e : "object" === Yi(e) ? t = Object.keys(e).map((function(t) {        return e[t]      })) : t.push(e), t = u(t), Promise.all(t.map(r))    }(e)  }}

External service receiving the order mutation

    • node3.ssdma.com

    Receives Apollo GraphQL requests for AliDropship order and product workflows, including setOrdersTIP and setOrdersIdAli variables.

What it can do

Permissions this extension asks for, as declared in version 3.0.0.95. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Show you desktop notifications

    notifications

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed AliDropship contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • node3.ssdma.com

    AliDropship sends data to node3.ssdma.com. No other extension we have analyzed sends data here.

  • tools.alidropship.com

    AliDropship sends data to tools.alidropship.com. No other extension we have analyzed sends data here.

Updated 30 September 2026jlnhdnbbikjkdejminhdpmejldiapdgn