Is AliExpress Coupon Finder safe?

Medium risk

AliExpress Coupon Finder opens a hidden tab to the developer's AliExpress affiliate link, attributing your purchase commission to them.

When you click 'Check them all' on an AliExpress order page, the extension silently opens and closes a background tab to the developer's affiliate link (s.click.aliexpress.com), planting a cookie that earns the developer commission on your purchase without disclosure. To find coupons it also reads your live AliExpress order details and sends them to AliExpress's own credentialed order and store APIs, and fetches its 'Universal' promo-code list at runtime from hardcoded Google Sheets CSV URLs that are injected into the checkout UI with no integrity check.

Alicouponsv3.1.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Check them all opens an AliExpress affiliate link

MediumunwantedCWE-506Dynamic sandbox

Clicking 'Check them all' on the AliExpress order-confirm page has the content script ask the background to open s.click.aliexpress.com/e/_9IAQMA inactively, then close it once loaded.

What actually happens

You did this

You click Check them all on the AliExpress order-confirm page.

The extension did this

The extension opens an AliExpress affiliate redirect in an inactive tab and removes that tab after it loads.

Concrete values in the affiliate-tab path

  • Affiliate redirect
    https://s.click.aliexpress.com/e/_9IAQMA

    This is the destination the extension loads after you click the coupon-check button.

  • Tab visibility
    Inactive background tab

    The destination opens in a tab that is not brought to the front, so the checkout page stays in view.

  • Local opt-out setting
    IS_AFF_LINK_DEACTIVATED = false

    If this local setting is enabled, the background script skips the affiliate tab.

  • Close condition
    status = complete

    The extension removes the affiliate tab once the browser reports the redirect has finished loading.

Captured request

GEThttps://s.click.aliexpress.com/e/_9IAQMA

No request body or response body was recorded; dynamic analysis did not exercise the checkout button.

The code that does this

Button handler and background affiliate-tab handler

Readable version

Content-script CheckThemAll button handler

deobfuscated/content.fd38c8e4.js
var tt=({universalCodes:e,storeCodes:t,setView:n})=>{let r=te(),i=e3(e,t);return(0,y.jsxs)(y.Fragment,{children:[(0,y.jsx)(e7,{onCloseClick:()=>n(S.NONE)}),(0,y.jsxs)(eF,{textAlign:"center",mt:2,children:[(0,y.jsx)(e5,{variant:"h6",className:r.line,children:`${i} ${chrome.i18n.getMessage("ModalStarter_LabelCodesAvailable")}`}),(0,y.jsx)(e5,{variant:"body1",className:r.line,children:i>0?chrome.i18n.getMessage("ModalStarter_LabelShouldWeTry"):(0,y.jsx)("span",{children:" "})}),(0,y.jsx)(eW,{className:r.line,disabled:0===i,variant:"contained",color:"primary",size:"large",onClick:()=>{n(S.WORKER),chrome.runtime.sendMessage({cmd:"CMD_OPEN_AFFILIATION_TAB"})},children:chrome.i18n.getMessage("ModalStarter_ButtonCheckThemAll")})]})]})}

Background message listener

deobfuscated/background.27ff7090.js
chrome.runtime.onMessage.addListener((e, r, i) => {    switch (e.cmd) {      case "CMD_OPEN_AFFILIATION_TAB":        return s.get("IS_AFF_LINK_DEACTIVATED", !1, "local").then(e => {          e || chrome.tabs.create({            active: !1,            url: "https://s.click.aliexpress.com/e/_9IAQMA"          }, e => {            let t = (r, i) => {              "complete" === i.status && r === e.id && (chrome.tabs.remove(r), chrome.tabs.onUpdated.removeListener(t))            };            chrome.tabs.onUpdated.addListener(t)          })        }).catch(console.log), !1;      case "CMD_GET_STORE_PROMO_CODES":        return g(e.data.itemsUrl).then(e => i(e)), !0;      case "CMD_GET_UNIVERSAL_PROMO_CODES":        return h.getUniversalCodes().then(e => {          var r;          let n = ((r = t) && r.__esModule ? r.default : r).parse(e, {            dynamicTyping: !0,            header: !0          });          i(n.errors.length ? null : n.data)        }).catch(e => {          console.log("Error CMD_GET_UNIVERSAL_PROMO_CODES", e), i(null)        }), !0;      case "CMD_GET_EXCHANGE_RATE":        return h.getCurrencyExchangeRate(e.data.currency).then(e => {          i(e.usd)        }).catch(e => {          console.log("Error CMD_GET_EXCHANGE_RATE", e), i(null)        }), !0;      case "CMD_GET_ORDER_CURRENCY":        return h.ali.getOrders(e.data.params).then(e => {          i(p(e))        }).catch(e => {          console.log("Error CMD_GET_ORDER_CURRENCY", e), i(null)        }), !0;      case "CMD_GET_AFFILIATION_COOKIE":        return chrome.cookies.get({          url: "https://shoppingcart.aliexpress.com/",          name: "xman_us_f"        }, e => {          i(e.value)        }), !0    }  })

External host contacted by this code path

    • s.click.aliexpress.com

    Receives the inactive-tab navigation to the AliExpress affiliate redirect when the button path runs.

What it can do

Permissions this extension asks for, as declared in version 3.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.1.0, which we have not unpacked yet.

  • Read and change your data on aliexpress.com

    http://*.aliexpress.com/* and 1 more

  • Read and change your data on alicoupons.org

    https://alicoupons.org/*

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed AliExpress Coupon Finder contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.comwidely used

    AliExpress Coupon Finder sends data to s.click.aliexpress.com. A widely used service: 37 other extensions we have analyzed send data here.

  • www.aliexpress.com

    AliExpress Coupon Finder sends data to www.aliexpress.com. 2 other extensions we have analyzed send data here.

  • shoppingcart.aliexpress.com

    AliExpress Coupon Finder sends data to shoppingcart.aliexpress.com. One other extension we have analyzed sends data here.

  • docs.google.com (Google Sheets)

    AliExpress Coupon Finder sends data to docs.google.com (Google Sheets). Named as a recipient in this extension's own analysis.

Updated 30 September 2026adanomdlalebngcphfbknoglbcdcbchb