Is Aliexpress Free invoice - AliInvoice™️ safe?

Medium risk

Aliexpress Free invoice - AliInvoice rewrites AliExpress shopping pages through an affiliate redirect.

When AliExpress product, shop, cart, or category pages load, the extension checks a remote configuration and can redirect the tab through an AliExpress affiliate deep-link URL. The redirect includes the original AliExpress destination and affiliate parameters before sending the browser on to the requested page.

Hunt_Sv3.2.4Chrome Web Store
45Risk
Who publishes it

Hunt_S - 3 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Hunt_S

Same store account

3 other listings published from this account, 9k+ users between them. 2 of them carry a finding.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

alidownpro.com
Also called by 1 other listing: AliDown - Aliexpress & AliBaba Images & Videos Downloader
eshopwell.xyz
Also called by 3 other listings, including alibill-%E2%80%93-aliexpress-invo, AliImage Search

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress Navigation Rerouted Through Extension's Own Affiliate Link

Opening an AliExpress item, store, cart, or category page routes the tab through s.click.aliexpress.com/deep_link.htm with the extension's affiliate ID, even if the config fetch fails: it falls back to a hardcoded key and redirects anyway.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress item, store, cart, or category page in a tab.

The extension did this

Before the page loads, the extension redirects that same tab through its own affiliate link, then sends you on to the page you asked for.

No click or interaction with the extension's own UI is needed, the redirect fires from a background navigation listener on every matching AliExpress URL.

The code that does this

The navigation listener and affiliate-link builder in the extension's service worker.

Readable version

Config lookup with hardcoded fallback

// Fetches the remote toggle/key from infinitytools.pro/aliinvoice.json.// If that request fails or returns anything the JSON parser can't use,// this ALWAYS returns an enabled config with a hardcoded affiliate key —// the redirect below does not require the remote server to be reachable.async function fetchConfig() {  try {    const res = await fetch("https://infinitytools.pro/aliinvoice.json", { cache: "no-store" });    if (!res.ok) throw new Error("Config fetch failed");    const json = await res.json();    return json.aliinvoice || null;  } catch (e) {    console.warn("Using fallback config");    return {      enabled: true,      affiliate_key: "_DBcuZW1",   // hardcoded fallback affiliate ID      permission_granted: true    };  }}

Affiliate link builder

// Wraps the current AliExpress URL in AliExpress's own affiliate-tracking// parameters, keyed to the extension's affiliate ID.function buildTargetUrl(baseUrl, affiliateKey) {  const clickId = crypto.randomUUID().replace(/-/g, '') + '-' + Date.now() + '-00000-' + affiliateKey;  const terminalId = crypto.randomUUID().replace(/-/g, '');  const params = new URLSearchParams({    aff_fcid: clickId,    tt: 'CPS_NORMAL',    aff_fsk: affiliateKey,          // affiliate ID tag    aff_platform: 'shareComponent-detail',    sk: affiliateKey,    aff_trace_key: clickId,    terminal_id: terminalId,    afSmartRedirect: 'y'  });  return `${baseUrl}?${params.toString()}`;}

The navigation listener that fires the redirect

// Runs on every tab navigation. If the destination is an AliExpress// item/store/cart/category page, the tab is redirected through// s.click.aliexpress.com before the original page ever loads.chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  if (changeInfo.status !== 'loading' || !tab.url?.startsWith('http')) return;  if (processedTabs.has(tabId)) return;  const isAliExpressProductPage = /https?:\/\/([a-z0-9-]+\.)?aliexpress\.(com|us|ru|fr|es|pt|de|ar)\/(item|store\/product|shop|cart|category|shoppingcart|shopcart)\//i.test(tab.url);  if (!isAliExpressProductPage) return;  processedTabs.add(tabId);  const config = await fetchConfig();  if (!config || !config.enabled || !config.permission_granted || !config.affiliate_key) {    processedTabs.delete(tabId);    return;  }  const url = new URL(tab.url);  if (url.searchParams.get('aff_fsk') === config.affiliate_key) {    // Already tagged with our own key — skip re-tagging.    processedTabs.delete(tabId);    return;  }  // Rebuild the URL wrapped in AliExpress's affiliate deep-link endpoint,  // then force the active tab to navigate there instead of the original URL.  const target = buildTargetUrl(`${url.origin}${url.pathname}`, config.affiliate_key);  const deepLink = 'https://s.click.aliexpress.com/deep_link.htm'    + '?aff_short_key=' + encodeURIComponent(config.affiliate_key)    + '&dl_target_url=' + encodeURIComponent(target)    + '&connected_by=aliinvoice';  chrome.tabs.update(tabId, { url: deepLink });});
Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DBcuZW1&dl_target_url=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109874827.html%3Faff_fcid%3Dcb383f52bd8d4a22894733db94ec9c1a-1786938718072-00000-_DBcuZW1%26tt%3DCPS_NORMAL%26aff_fsk%3D_DBcuZW1%26aff_platform%3DshareComponent-detail%26sk%3D_DBcuZW1%26aff_trace_key%3Dcb383f52bd8d4a22894733db94ec9c1a-1786938718072-00000-_DBcuZW1%26terminal_id%3D36de97524aaf495b808d5254df4530ac%26afSmartRedirect%3Dy&connected_by=aliinvoice

302 redirect. Observed during dynamic analysis: a planted AliExpress item URL was opened in the active tab; the service worker's chrome.tabs.update() call carried that exact URL forward as dl_target_url, and the 302 response chain landed back on the same item page decorated with AliExpress's own affiliate parameters (aff_fcid, aff_fsk, sk, aff_trace_key, terminal_id, afSmartRedirect=y).

Where the redirected navigation goes
    • s.click.aliexpress.com

    AliExpress's own affiliate deep-link endpoint. Receives the destination URL and the extension's affiliate ID, then 302s the tab back to the page with tracking parameters attached.

    • infinitytools.pro

    Remote config host queried before each redirect for whether it's enabled and which key to use. Not affiliated with AliExpress; a hardcoded key is used if unreachable or errors.

Where it sends data

Destinations our analysis observed Aliexpress Free invoice - AliInvoice™️ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Aliexpress Free invoice - AliInvoice™️ sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

Updated 30 September 2026afpggcpmimlknonanaomkdlebdpeaicg