Is Shopping & Tracking Helper safe?
Shopping & Tracking Helper downloads redirect rules that can change matching shopping page navigations.
The extension fetches affiliate redirect rules from cdn.derschuler.com and stores the patterns used to match future browsing. When a matching AliExpress or related shopping URL is opened, it can update the tab to a configured or hardcoded affiliate destination such as s.click.aliexpress.com or alitems.co.
Who publishes it@fmschuler - no other listings under this identity, 2 shared hostnames
@fmschuler - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote Server Controls Which Sites Get Redirected
The extension fetches a JSON ruleset from cdn.derschuler.com at startup, refreshed every 12h; the ruleset decides which sites redirect and where.
A captured ruleset held 13 rules: Amazon Brazil, Booking, Shopee Brazil, Temu, travel sites.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You navigate to a page on a site the extension's remotely-fetched ruleset currently matches, for example amazon.com.br.
The set of matched sites is not fixed in the extension's code; it comes from a JSON file the extension re-downloads roughly every 12 hours.
The tab is rewritten to the destination or parameter the remote ruleset specifies for that site.
During dynamic analysis, navigating to https://www.amazon.com.br/ produced a live chrome.tabs.update to https://www.amazon.com.br/?tag=afiliadopompe-20, the exact 'replace' rule for amazon.com.br in the currently served ruleset.
200 OK, JSON body listing the current redirect rules (captured in full below)
{ "aff": [ { "match": "amazon.com.br", "redir": "amazon.com.br", "type": "replace", "url": "tag|afiliadopompe-20" }, { "match": "shein.com", "redir": "shein.com", "type": "replace", "url": "url_from|affiliate_koc_4172377525" }, { "match": "temu.com", "redir": "temu.com", "type": "url", "url": "https://temu.to/k/upd9pfd225g" }, { "match": "tudoazul.voeazul.com.br/web/azul/clube", "redir": "tudoazul", "type": "url", "url": "https://apps.voeazul.com.br/TudoAzulClub/share-mgm.html?hash=%2B0G1jg%2BWXwkTzJvDEpa0uSaTUBv3dfSsIAZ6wC4j%2BgA%C3%9FC" }, { "match": "smiles.com.br/cadastro|smiles.com.br/clube", "redir": "clubesmiles", "type": "url", "url": "https://www.smiles.com.br/indicar-amigos/indicado?icode=1-18324-189288" }, { "match": "smiles.com.br/checkout", "redir": "smiles", "type": "url", "url": "https://www.smiles.com.br/checkout?icode=1-18324-189288" }, { "match": "hurb.com", "redir": "hurb.com", "type": "replace", "url": "cmp|561613" }, { "match": "assistcard.com/br|google.com(.*?)=seguro(.*?)viagem", "redir": "assistcard.com", "type": "url", "url": "https://stvkr.com/v2/click-Apm51-K7xyyG-LqV5G-0ed47ca7?tl=1" }, { "match": "booking.com", "redir": "booking", "type": "replace", "url": "aid|1918372" }, { "match": "trivago.com|expedia.com|hotels.com|priceline.com|trip.com|vrbo.com", "redir": "booking_redir", "type": "url", "url": "https://www.booking.com/?aid=1918372" }, { "match": "shopee.com.br", "redir": "shopee", "type": "url", "url": "https://s.shopee.com.br/20lyCOyZr6" }, { "match": "banggood.com", "redir": "banggood", "type": "replace", "url": "p|HF22081531105201504Q" }, { "match": "78eda9e84f", "redir": "americanas", "type": "url", "url": "https://www.americanas.com.br/" } ]}Fetching and applying the remote ruleset (scripts/background.js)
fetchDataRedirects — download and cache the ruleset
// Called on install and re-called every 12h from fetchIfNeeded().async function fetchDataRedirects() { const response = await fetch('https://cdn.derschuler.com/extension_aff_redirects.json'); const ruleset = await response.json(); // Build one combined regex from every rule's match pattern, so // onBeforeNavigate can test a navigated URL against all rules at once. const matchPatterns = ruleset.aff.map(rule => rule.match); currentRuleset = ruleset; combinedMatchPattern = matchPatterns.join('|'); const nextRefresh = new Date(Date.now() + 720 * 60000); // 12 hours chrome.storage.local.set({ aff_redirects: ruleset, aff_urlMatches: combinedMatchPattern, aff_redirLastSaved: nextRefresh.toString() });}onBeforeNavigate — apply a matching remote rule
try { if (navigatedUrl.match(combinedMatchPattern)) { readVarRedirect(); for (const rule of currentRuleset.aff) { const alreadyAppliedThisRule = redirectState === rule.redir; if (navigatedUrl.match(rule.match) && !alreadyAppliedThisRule) { redirectState = rule.redir; setRedirLastSaved(); // type 'replace': rewrite one query parameter in the current URL. // any other type ('url'): swap the tab to rule.url outright. let destination = rule.url; if (rule.type === 'replace') { const [paramName, paramValue] = rule.url.split('|'); destination = replaceOrAddUrlParam(navigatedUrl, paramName, paramValue); } chrome.tabs.update(tabId, { url: destination }); } } }} catch (e) { /* swallow */ }- Amazon Brazil affiliate tagtag=afiliadopompe-20
Visiting amazon.com.br appends a 'tag' query parameter with this value, crediting the visit to the developer's Amazon affiliate account.
- Booking.com affiliate IDaid=1918372
You stay on booking.com, but every visit is tagged with this affiliate ID via the same replace mechanism.
- Temu redirect targethttps://temu.to/k/upd9pfd225g
Instead of adding a parameter, the whole tab is sent to this shortened affiliate link before Temu loads.
- Travel-insurance redirect targethttps://stvkr.com/v2/click-Apm51-K7xyyG-LqV5G-0ed47ca7?tl=1
A visit to AssistCard, or a matching travel-insurance search, routes through this click-tracking link before reaching the insurer's site.
- cdn.derschuler.com
Supplies the live redirect ruleset, re-fetched roughly every 12 hours. Matched sites and destinations can change anytime from this server without a new extension release.
- temu.to
Affiliate redirect shortlink used for the Temu rule in the captured ruleset.
- stvkr.com
Third-party click-tracking redirector used for the AssistCard travel-insurance rule in the captured ruleset.
Hardcoded Affiliate Redirect on Every AliExpress Visit
On every AliExpress or AliExpress.ru navigation, the background worker routes the tab through a hardcoded affiliate link (s.click.aliexpress.com; alitems.co for CIS) unless it already carries the extension's code, replacing any other code.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You navigate to an AliExpress or AliExpress.ru page, the shopping cart, an item page, or the homepage.
This includes pages that already carry a different affiliate code you clicked through from elsewhere.
The extension redirects your tab through its own hardcoded affiliate link before the page loads.
AliExpress then sends you back to the page you were trying to reach, now carrying the extension's affiliate tracking ID instead.
The navigation listeners that insert the extension's affiliate link (scripts/background.js)
onBeforeNavigate — redirect on arrival
// Fires before every navigation. u_home is either the global affiliate// link ('https://s.click.aliexpress.com/e/_Af1GBJ') or, for CIS-locale// users, an alitems.co link.if (currentUrl.includes('aliexpress.')) { readVarRedirect(); const alreadyRedirectedThisSession = redirectState === 'aliexpress'; const hasOwnOrPartnerCode = currentUrl.match(EXTENSION_AND_PARTNER_CODES); if (!currentUrl.includes('third') && !currentUrl.includes('login') && !currentUrl.includes('portals') && !alreadyRedirectedThisSession && !hasOwnOrPartnerCode) { redirectState = 'aliexpress'; setRedirLastSaved(); chrome.tabs.update(tabId, { url: affiliateHomeLink }); } // Same check, specifically for the shopping cart page. if (redirectCartOnce && cleanUrl === 'https://shoppingcart.aliexpress.com/shopcart/shopcartDetail.htm') { redirectState = 'aliexpress'; redirectCartOnce = false; setRedirLastSaved(); chrome.tabs.update(tabId, { url: affiliateCartLink }); }}onUpdated — override any other affiliate code already on the URL
// Fires whenever a tab finishes loading. This listener also matches pages// that already carry a foreign aff_fcid value — as long as that value is// not one of the extension's own/partner codes, the tab is redirected// again through the extension's own affiliate link.if (currentUrl.includes('aliexpress.') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) { // CIS-locale users go through the alitems.co redirector. if (isRussiaCIS && navigationComplete && currentUrl.includes('aliexpress.') && currentUrl.includes('aff_fcid') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) { redirectState = 'aliexpress'; setRedirLastSaved(); chrome.tabs.update(tabId, { url: cisHomeLink }); } // Item pages go through a deep-link wrapper instead of the plain home link. else if (!isRussiaCIS && navigationComplete && currentUrl.includes('aliexpress.com/item/') && currentUrl.includes('aff_fcid') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) { redirectState = 'aliexpress'; setRedirLastSaved(); chrome.tabs.update(tabId, { url: deepLinkPrefix + currentUrl.split('?')[0] + deepLinkSuffix }); } // Any other AliExpress page carrying a foreign affiliate code. else if (!isRussiaCIS && navigationComplete && currentUrl.includes('aliexpress.com') && currentUrl.includes('aff_fcid') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) { redirectState = 'aliexpress'; setRedirLastSaved(); chrome.tabs.update(tabId, { url: affiliateHomeLink }); }}302 redirect to https://www.aliexpress.com/?aff_fcid=fb376e2da2644d7a93ed6c7517ceabb7-1786961012973-03850-_Af1GBJ&tt=CPS_NORMAL&aff_fsk=_Af1GBJ&aff_platform=portals-tool&sk=_Af1GBJ&aff_trace_key=fb376e2da2644d7a93ed6c7517ceabb7-1786961012973-03850-_Af1GBJ&terminal_id=4ac191c980b5472f9d88930a28a30132&afSmartRedirect=y, the browser lands back on the page you were originally trying to reach, now carrying the extension's affiliate trace key.
- Affiliate tracking IDaff_fcid=fb376e2da2644d7a93ed6c7517ceabb7-1786961012973-03850-_Af1GBJ
Ties your visit and any resulting purchase to the extension's own AliExpress affiliate account rather than one you chose.
- Affiliate channelaff_platform=portals-tool
Marks the referral as coming through AliExpress's portals-tool affiliate channel, which the extension uses for every redirect.
- Session/terminal identifierterminal_id=4ac191c980b5472f9d88930a28a30132
A per-session ID AliExpress assigns during the redirect, tied to your browser instance for this visit.
- Destination pagehttps://www.aliexpress.com/
The redirect preserves the page you were originally headed to, so the only visible change is the added tracking parameters.
- s.click.aliexpress.com
AliExpress's own affiliate redirector. The hardcoded link (_Af1GBJ for browsing, _ALqJA7 for cart) attributes the visit and purchase to the extension's affiliate account.
- alitems.co
Alternate affiliate redirector used in place of s.click.aliexpress.com for users whose locale or country is detected as CIS.
Where it sends data
Destinations our analysis observed AliExplorer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- s.click.aliexpress.com
AliExplorer sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.
- alitems.co
AliExplorer sends data to alitems.co. 2 other extensions we have analysed send data here.
- cdn.derschuler.com
AliExplorer sends data to cdn.derschuler.com. No other extension we have analysed sends data here.