Is AliExpress Coupon Finder safe?

Medium risk

AliExpress Coupon Finder opens a hidden tab to the developer's AliExpress affiliate link, attributing your purchase commission to them.

When you click 'Check them all' on an AliExpress order page, the extension silently opens and closes a background tab to the developer's affiliate link (s.click.aliexpress.com), planting a cookie that earns the developer commission on your purchase without disclosure. To find coupons it also reads your live AliExpress order details and sends them to AliExpress's own credentialed order and store APIs, and fetches its 'Universal' promo-code list at runtime from hardcoded Google Sheets CSV URLs that are injected into the checkout UI with no integrity check.

Alicouponsv3.0.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Check them all opens an AliExpress affiliate link

Clicking 'Check them all' on the AliExpress order-confirm page has the content script ask the background to open s.click.aliexpress.com/e/_9IAQMA inactively, then close it once loaded.

Testing didn't exercise this; no response was recorded.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click Check them all on the AliExpress order-confirm page.

The extension did this

The extension opens an AliExpress affiliate redirect in an inactive tab and removes that tab after it loads.

02EvidenceFIELD TABLE
Concrete values in the affiliate-tab path
FieldValueWhy it matters
Affiliate redirect
https://s.click.aliexpress.com/e/_9IAQMAThis is the destination the extension loads after you click the coupon-check button.
Tab visibility
Inactive background tabThe destination opens in a tab that is not brought to the front, so the checkout page stays in view.
Local opt-out setting
IS_AFF_LINK_DEACTIVATED = falseIf this local setting is enabled, the background script skips the affiliate tab.
Close condition
status = completeThe extension removes the affiliate tab once the browser reports the redirect has finished loading.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://s.click.aliexpress.com/e/_9IAQMA
No request body or response body was recorded; dynamic analysis did not exercise the checkout button.
04EvidenceCODE COMPARE
The code that does this

Button handler and background affiliate-tab handler

What it actually does
Content-script CheckThemAll button handlerdeobfuscated/content.fd38c8e4.js
var tt=({universalCodes:e,storeCodes:t,setView:n})=>{let r=te(),i=e3(e,t);return(0,y.jsxs)(y.Fragment,{children:[(0,y.jsx)(e7,{onCloseClick:()=>n(S.NONE)}),(0,y.jsxs)(eF,{textAlign:"center",mt:2,children:[(0,y.jsx)(e5,{variant:"h6",className:r.line,children:`${i} ${chrome.i18n.getMessage("ModalStarter_LabelCodesAvailable")}`}),(0,y.jsx)(e5,{variant:"body1",className:r.line,children:i>0?chrome.i18n.getMessage("ModalStarter_LabelShouldWeTry"):(0,y.jsx)("span",{children:" "})}),(0,y.jsx)(eW,{className:r.line,disabled:0===i,variant:"contained",color:"primary",size:"large",onClick:()=>{n(S.WORKER),chrome.runtime.sendMessage({cmd:"CMD_OPEN_AFFILIATION_TAB"})},children:chrome.i18n.getMessage("ModalStarter_ButtonCheckThemAll")})]})]})}
Background message listenerdeobfuscated/background.27ff7090.js
chrome.runtime.onMessage.addListener((e, r, i) => {
    switch (e.cmd) {
      case "CMD_OPEN_AFFILIATION_TAB":
        return s.get("IS_AFF_LINK_DEACTIVATED", !1, "local").then(e => {
          e || chrome.tabs.create({
            active: !1,
            url: "https://s.click.aliexpress.com/e/_9IAQMA"
          }, e => {
            let t = (r, i) => {
              "complete" === i.status && r === e.id && (chrome.tabs.remove(r), chrome.tabs.onUpdated.removeListener(t))
            };
            chrome.tabs.onUpdated.addListener(t)
          })
        }).catch(console.log), !1;
      case "CMD_GET_STORE_PROMO_CODES":
        return g(e.data.itemsUrl).then(e => i(e)), !0;
      case "CMD_GET_UNIVERSAL_PROMO_CODES":
        return h.getUniversalCodes().then(e => {
          var r;
          let n = ((r = t) && r.__esModule ? r.default : r).parse(e, {
            dynamicTyping: !0,
            header: !0
          });
          i(n.errors.length ? null : n.data)
        }).catch(e => {
          console.log("Error CMD_GET_UNIVERSAL_PROMO_CODES", e), i(null)
        }), !0;
      case "CMD_GET_EXCHANGE_RATE":
        return h.getCurrencyExchangeRate(e.data.currency).then(e => {
          i(e.usd)
        }).catch(e => {
          console.log("Error CMD_GET_EXCHANGE_RATE", e), i(null)
        }), !0;
      case "CMD_GET_ORDER_CURRENCY":
        return h.ali.getOrders(e.data.params).then(e => {
          i(p(e))
        }).catch(e => {
          console.log("Error CMD_GET_ORDER_CURRENCY", e), i(null)
        }), !0;
      case "CMD_GET_AFFILIATION_COOKIE":
        return chrome.cookies.get({
          url: "https://shoppingcart.aliexpress.com/",
          name: "xman_us_f"
        }, e => {
          i(e.value)
        }), !0
    }
  })
05EvidenceTHIRD PARTY LIST
External host contacted by this code path
  • s.click.aliexpress.com

    Receives the inactive-tab navigation to the AliExpress affiliate redirect when the button path runs.

Data recipients

s.click.aliexpress.comshoppingcart.aliexpress.comwww.aliexpress.comdocs.google.com (Google Sheets)
Updated 17 September 2026adanomdlalebngcphfbknoglbcdcbchb