Is AliExpert Shopping Assistant safe?
AliExpert Shopping Assistant opens remote-configured affiliate redirects in hidden tabs on AliExpress product pages.
On supported shopping pages, the extension sends the current page URL to its service worker and fetches redirect rules from a remote configuration file. For AliExpress product pages, those rules can create or update a non-active tab to an affiliate redirect URL that includes the product page being viewed.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress Product Pages Routed Through an Affiliate Redirect Chain
On aliexpress.com pages, AliExpert's service worker fetches config from jaiden-dev.github.io, then redirects the tab through an affiliate link back to same product, tagged, ~11ms later.
A competing tag speeds the redirect (~30s vs ~24h).
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a product page on aliexpress.com, aliexpress.us, aliexpress.ru, or aliexpress.co.il.
The service worker fetches a remote config file, then redirects the tab through an affiliate link and back to the same product page, now carrying affiliate tracking parameters.
No click on the page is required; the redirect starts within milliseconds of the config fetch completing.
- The product page you're viewinghttps://www.aliexpress.com/item/1005006109041730.html
The AliExpress item URL is embedded in the redirect link and passed through two intermediary sites before you land back on the same product.
- A per-install identifiera4c1e9f0-3b7d-4e12-9c8a-1f6d2b90ee31
A UUID unique to your install, plus the extension ID and version, is sent to the remote-config server on every config fetch.
- Affiliate tag added to the URLaff_platform=api-new-link-generate&aff_trace_key=<redacted>
The product URL you land on afterward carries new tracking parameters identifying this extension's affiliate account.
302 redirect to AliExpress's own affiliate program at s.click.aliexpress.com/deep_link.htm?aff_short_key=_oBwTAWR&dl_target_url=https://www.aliexpress.com/item/1005006109041730.html, which redirects again to the same product page now carrying aff_fsk=_oBwTAWR&aff_platform=api-new-link-generate&aff_trace_key=<redacted>.
Code deciding whether and how fast to redirect based on any existing competing affiliate tag.
The competing-tag check
// True when the URL already contains one of the config's tracked affiliate// parameter names (e.g. a competitor's aff_fcid) AND does not yet contain// this extension's own "already processed" marker.function hasCompetingAffiliateTag(url, config) { return config.decodingMetaArray.some((param) => url.includes(param)) && !url.includes(config.decodingTimeTagName);}The throttle branch
// If the URL already carries a competing affiliate tag, redirect after a// SHORT throttle (config.decodingTimeSmall). If not, redirect only after a// LONG throttle (config.decodingTime). In the config observed during testing,// decodingTimeSmall was 30 seconds and decodingTime was 24 hours.const now = Date.now();if (config.changeAlreadyDecoded !== false && hasCompetingAffiliateTag(url, config)) { if (await ThrottleStore.isExpired(tabId, config.decodingTimeSmall)) { if (await maybeRedirect(now, redirectUrl, url, tabId)) { sendStatusCheck(statusUrl, redirectUrl, infoPayload, tabId); } }} else { const lastRun = await getLastRunTime(); if (now - lastRun < config.decodingTime) { return {}; } // ...falls through to the same-tab redirect for untagged URLs}- jaiden-dev.github.io
Serves the remote config (newsdec.json, news.json): redirect template, parameter names, throttle timings. Receives the extension ID, version, and a per-install UUID each fetch.
- clck.my
Intermediary short-link domain that receives the full product URL and issues the first redirect hop.
- s.click.aliexpress.com
AliExpress's own affiliate deep-link endpoint. Issues the final redirect back to the product page with affiliate tracking parameters attached.
Run in the extension's service worker console to log the remote config fetch and the resulting tab redirect, without needing to capture raw network traffic.
- Chrome with Developer mode enabled
// aliexpert-redirect-inspector.js// Paste into the AliExpert service worker's DevTools console// (chrome://extensions -> Developer mode -> "service worker" link for// AliExpert Shopping Assistant). Logs the remote config fetch and the// resulting tab redirect so you can see the affiliate-redirect chain.(function () { const origUpdate = chrome.tabs.update.bind(chrome.tabs); chrome.tabs.update = function (tabId, updateProps, ...rest) { if (updateProps && updateProps.url) { console.log('[ALIEXPERT_REDIRECT] tabs.update ->', updateProps.url, 'tabId=', tabId); } return origUpdate(tabId, updateProps, ...rest); }; const origFetch = self.fetch.bind(self); self.fetch = function (input, init) { const url = typeof input === 'string' ? input : input.url; if (url && url.includes('jaiden-dev.github.io/aliexpert/news/')) { console.log('[ALIEXPERT_REDIRECT] remote config fetch ->', url); return origFetch(input, init).then((res) => { res.clone().text().then((body) => console.log('[ALIEXPERT_REDIRECT] config response:', body) ); return res; }); } return origFetch(input, init); }; console.log('[ALIEXPERT_REDIRECT_INSPECTOR] installed. Visit an AliExpress product page and watch the console.');})();- 1Install AliExpert.
- 2Open chrome://extensions, enable Developer mode, click "service worker".
- 3Paste this script in DevTools console.
- 4Visit an aliexpress.com/item/*.html page and watch for [ALIEXPERT_REDIRECT] logs.
What it can do
Permissions this extension asks for, as declared in version 2.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
See the address and title of every tab you have open
tabs
See every page you navigate to, as you navigate to it
webNavigation
Watch every request your browser makes
webRequest
Where it sends data
Destinations our analysis observed AliExpert contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- clck.my
AliExpert sends data to clck.my. No other extension we have analysed sends data here.