Is Shopping & Tracking Helper safe?

High risk

Shopping & Tracking Helper downloads redirect rules that can change matching shopping page navigations.

The extension fetches affiliate redirect rules from cdn.derschuler.com and stores the patterns used to match future browsing. When a matching AliExpress or related shopping URL is opened, it can update the tab to a configured or hardcoded affiliate destination such as s.click.aliexpress.com or alitems.co.

@fmschulerv3.8.1Chrome Web Store
75Risk
Who publishes it

@fmschuler - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
@fmschuler

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

alitems.co
Also called by 5 other listings, including AliExpress Invoice Creator, Ali Insider- AliExpress Product Research Tool
global.cainiao.com
Also called by 5 other listings, including 速卖通客服助手, AliExpress Parcels - My Orders

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote Server Controls Which Sites Get Redirected

The extension fetches a JSON ruleset from cdn.derschuler.com at startup, refreshed every 12h; the ruleset decides which sites redirect and where.

A captured ruleset held 13 rules: Amazon Brazil, Booking, Shopee Brazil, Temu, travel sites.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You navigate to a page on a site the extension's remotely-fetched ruleset currently matches, for example amazon.com.br.

The set of matched sites is not fixed in the extension's code; it comes from a JSON file the extension re-downloads roughly every 12 hours.

The extension did this

The tab is rewritten to the destination or parameter the remote ruleset specifies for that site.

During dynamic analysis, navigating to https://www.amazon.com.br/ produced a live chrome.tabs.update to https://www.amazon.com.br/?tag=afiliadopompe-20, the exact 'replace' rule for amazon.com.br in the currently served ruleset.

Captured request
GEThttps://cdn.derschuler.com/extension_aff_redirects.json

200 OK, JSON body listing the current redirect rules (captured in full below)

Body
{  "aff": [    {      "match": "amazon.com.br",      "redir": "amazon.com.br",      "type": "replace",      "url": "tag|afiliadopompe-20"    },    {      "match": "shein.com",      "redir": "shein.com",      "type": "replace",      "url": "url_from|affiliate_koc_4172377525"    },    {      "match": "temu.com",      "redir": "temu.com",      "type": "url",      "url": "https://temu.to/k/upd9pfd225g"    },    {      "match": "tudoazul.voeazul.com.br/web/azul/clube",      "redir": "tudoazul",      "type": "url",      "url": "https://apps.voeazul.com.br/TudoAzulClub/share-mgm.html?hash=%2B0G1jg%2BWXwkTzJvDEpa0uSaTUBv3dfSsIAZ6wC4j%2BgA%C3%9FC"    },    {      "match": "smiles.com.br/cadastro|smiles.com.br/clube",      "redir": "clubesmiles",      "type": "url",      "url": "https://www.smiles.com.br/indicar-amigos/indicado?icode=1-18324-189288"    },    {      "match": "smiles.com.br/checkout",      "redir": "smiles",      "type": "url",      "url": "https://www.smiles.com.br/checkout?icode=1-18324-189288"    },    {      "match": "hurb.com",      "redir": "hurb.com",      "type": "replace",      "url": "cmp|561613"    },    {      "match": "assistcard.com/br|google.com(.*?)=seguro(.*?)viagem",      "redir": "assistcard.com",      "type": "url",      "url": "https://stvkr.com/v2/click-Apm51-K7xyyG-LqV5G-0ed47ca7?tl=1"    },    {      "match": "booking.com",      "redir": "booking",      "type": "replace",      "url": "aid|1918372"    },    {      "match": "trivago.com|expedia.com|hotels.com|priceline.com|trip.com|vrbo.com",      "redir": "booking_redir",      "type": "url",      "url": "https://www.booking.com/?aid=1918372"    },    {      "match": "shopee.com.br",      "redir": "shopee",      "type": "url",      "url": "https://s.shopee.com.br/20lyCOyZr6"    },    {      "match": "banggood.com",      "redir": "banggood",      "type": "replace",      "url": "p|HF22081531105201504Q"    },    {      "match": "78eda9e84f",      "redir": "americanas",      "type": "url",      "url": "https://www.americanas.com.br/"    }  ]}
The code that does this

Fetching and applying the remote ruleset (scripts/background.js)

Readable version

fetchDataRedirects — download and cache the ruleset

// Called on install and re-called every 12h from fetchIfNeeded().async function fetchDataRedirects() {  const response = await fetch('https://cdn.derschuler.com/extension_aff_redirects.json');  const ruleset = await response.json();  // Build one combined regex from every rule's match pattern, so  // onBeforeNavigate can test a navigated URL against all rules at once.  const matchPatterns = ruleset.aff.map(rule => rule.match);  currentRuleset = ruleset;  combinedMatchPattern = matchPatterns.join('|');  const nextRefresh = new Date(Date.now() + 720 * 60000); // 12 hours  chrome.storage.local.set({    aff_redirects: ruleset,    aff_urlMatches: combinedMatchPattern,    aff_redirLastSaved: nextRefresh.toString()  });}

onBeforeNavigate — apply a matching remote rule

try {  if (navigatedUrl.match(combinedMatchPattern)) {    readVarRedirect();    for (const rule of currentRuleset.aff) {      const alreadyAppliedThisRule = redirectState === rule.redir;      if (navigatedUrl.match(rule.match) && !alreadyAppliedThisRule) {        redirectState = rule.redir;        setRedirLastSaved();        // type 'replace': rewrite one query parameter in the current URL.        // any other type ('url'): swap the tab to rule.url outright.        let destination = rule.url;        if (rule.type === 'replace') {          const [paramName, paramValue] = rule.url.split('|');          destination = replaceOrAddUrlParam(navigatedUrl, paramName, paramValue);        }        chrome.tabs.update(tabId, { url: destination });      }    }  }} catch (e) { /* swallow */ }
A sample of the redirect rules the remote server currently supplies
  • Amazon Brazil affiliate tag
    tag=afiliadopompe-20

    Visiting amazon.com.br appends a 'tag' query parameter with this value, crediting the visit to the developer's Amazon affiliate account.

  • Booking.com affiliate ID
    aid=1918372

    You stay on booking.com, but every visit is tagged with this affiliate ID via the same replace mechanism.

  • Temu redirect target
    https://temu.to/k/upd9pfd225g

    Instead of adding a parameter, the whole tab is sent to this shortened affiliate link before Temu loads.

  • Travel-insurance redirect target
    https://stvkr.com/v2/click-Apm51-K7xyyG-LqV5G-0ed47ca7?tl=1

    A visit to AssistCard, or a matching travel-insurance search, routes through this click-tracking link before reaching the insurer's site.

Hosts involved in the remote-config redirect chain
    • cdn.derschuler.com

    Supplies the live redirect ruleset, re-fetched roughly every 12 hours. Matched sites and destinations can change anytime from this server without a new extension release.

    • temu.to

    Affiliate redirect shortlink used for the Temu rule in the captured ruleset.

    • stvkr.com

    Third-party click-tracking redirector used for the AssistCard travel-insurance rule in the captured ruleset.

Hardcoded Affiliate Redirect on Every AliExpress Visit

On every AliExpress or AliExpress.ru navigation, the background worker routes the tab through a hardcoded affiliate link (s.click.aliexpress.com; alitems.co for CIS) unless it already carries the extension's code, replacing any other code.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You navigate to an AliExpress or AliExpress.ru page, the shopping cart, an item page, or the homepage.

This includes pages that already carry a different affiliate code you clicked through from elsewhere.

The extension did this

The extension redirects your tab through its own hardcoded affiliate link before the page loads.

AliExpress then sends you back to the page you were trying to reach, now carrying the extension's affiliate tracking ID instead.

The code that does this

The navigation listeners that insert the extension's affiliate link (scripts/background.js)

Readable version

onBeforeNavigate — redirect on arrival

// Fires before every navigation. u_home is either the global affiliate// link ('https://s.click.aliexpress.com/e/_Af1GBJ') or, for CIS-locale// users, an alitems.co link.if (currentUrl.includes('aliexpress.')) {  readVarRedirect();  const alreadyRedirectedThisSession = redirectState === 'aliexpress';  const hasOwnOrPartnerCode = currentUrl.match(EXTENSION_AND_PARTNER_CODES);  if (!currentUrl.includes('third') && !currentUrl.includes('login') &&      !currentUrl.includes('portals') && !alreadyRedirectedThisSession &&      !hasOwnOrPartnerCode) {    redirectState = 'aliexpress';    setRedirLastSaved();    chrome.tabs.update(tabId, { url: affiliateHomeLink });  }  // Same check, specifically for the shopping cart page.  if (redirectCartOnce && cleanUrl === 'https://shoppingcart.aliexpress.com/shopcart/shopcartDetail.htm') {    redirectState = 'aliexpress';    redirectCartOnce = false;    setRedirLastSaved();    chrome.tabs.update(tabId, { url: affiliateCartLink });  }}

onUpdated — override any other affiliate code already on the URL

// Fires whenever a tab finishes loading. This listener also matches pages// that already carry a foreign aff_fcid value — as long as that value is// not one of the extension's own/partner codes, the tab is redirected// again through the extension's own affiliate link.if (currentUrl.includes('aliexpress.') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) {  // CIS-locale users go through the alitems.co redirector.  if (isRussiaCIS && navigationComplete && currentUrl.includes('aliexpress.') &&      currentUrl.includes('aff_fcid') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) {    redirectState = 'aliexpress';    setRedirLastSaved();    chrome.tabs.update(tabId, { url: cisHomeLink });  }  // Item pages go through a deep-link wrapper instead of the plain home link.  else if (!isRussiaCIS && navigationComplete && currentUrl.includes('aliexpress.com/item/') &&      currentUrl.includes('aff_fcid') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) {    redirectState = 'aliexpress';    setRedirLastSaved();    chrome.tabs.update(tabId, { url: deepLinkPrefix + currentUrl.split('?')[0] + deepLinkSuffix });  }  // Any other AliExpress page carrying a foreign affiliate code.  else if (!isRussiaCIS && navigationComplete && currentUrl.includes('aliexpress.com') &&      currentUrl.includes('aff_fcid') && !currentUrl.match(EXTENSION_AND_PARTNER_CODES)) {    redirectState = 'aliexpress';    setRedirLastSaved();    chrome.tabs.update(tabId, { url: affiliateHomeLink });  }}
Captured request
GEThttps://s.click.aliexpress.com/e/_Af1GBJ

302 redirect to https://www.aliexpress.com/?aff_fcid=fb376e2da2644d7a93ed6c7517ceabb7-1786961012973-03850-_Af1GBJ&tt=CPS_NORMAL&aff_fsk=_Af1GBJ&aff_platform=portals-tool&sk=_Af1GBJ&aff_trace_key=fb376e2da2644d7a93ed6c7517ceabb7-1786961012973-03850-_Af1GBJ&terminal_id=4ac191c980b5472f9d88930a28a30132&afSmartRedirect=y, the browser lands back on the page you were originally trying to reach, now carrying the extension's affiliate trace key.

What gets added to the URL by the redirect
  • Affiliate tracking ID
    aff_fcid=fb376e2da2644d7a93ed6c7517ceabb7-1786961012973-03850-_Af1GBJ

    Ties your visit and any resulting purchase to the extension's own AliExpress affiliate account rather than one you chose.

  • Affiliate channel
    aff_platform=portals-tool

    Marks the referral as coming through AliExpress's portals-tool affiliate channel, which the extension uses for every redirect.

  • Session/terminal identifier
    terminal_id=4ac191c980b5472f9d88930a28a30132

    A per-session ID AliExpress assigns during the redirect, tied to your browser instance for this visit.

  • Destination page
    https://www.aliexpress.com/

    The redirect preserves the page you were originally headed to, so the only visible change is the added tracking parameters.

Where the redirect sends you
    • s.click.aliexpress.com

    AliExpress's own affiliate redirector. The hardcoded link (_Af1GBJ for browsing, _ALqJA7 for cart) attributes the visit and purchase to the extension's affiliate account.

    • alitems.co

    Alternate affiliate redirector used in place of s.click.aliexpress.com for users whose locale or country is detected as CIS.

Where it sends data

Destinations our analysis observed AliExplorer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    AliExplorer sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

  • alitems.co

    AliExplorer sends data to alitems.co. 2 other extensions we have analysed send data here.

  • cdn.derschuler.com

    AliExplorer sends data to cdn.derschuler.com. No other extension we have analysed sends data here.

Updated 30 September 2026lapplaccfgkiogonfiegngjmffjongbh