Is Aliexpress Free invoice - AliInvoice™️ safe?
Aliexpress Free invoice - AliInvoice rewrites AliExpress shopping pages through an affiliate redirect.
When AliExpress product, shop, cart, or category pages load, the extension checks a remote configuration and can redirect the tab through an AliExpress affiliate deep-link URL. The redirect includes the original AliExpress destination and affiliate parameters before sending the browser on to the requested page.
Who publishes itHunt_S - 3 other listings from the same operator, 2 of them carrying a finding
Hunt_S - 3 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 9k+ users between them. 2 of them carry a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress Navigation Rerouted Through Extension's Own Affiliate Link
Opening an AliExpress item, store, cart, or category page routes the tab through s.click.aliexpress.com/deep_link.htm with the extension's affiliate ID, even if the config fetch fails: it falls back to a hardcoded key and redirects anyway.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open an AliExpress item, store, cart, or category page in a tab.
Before the page loads, the extension redirects that same tab through its own affiliate link, then sends you on to the page you asked for.
No click or interaction with the extension's own UI is needed, the redirect fires from a background navigation listener on every matching AliExpress URL.
The navigation listener and affiliate-link builder in the extension's service worker.
Config lookup with hardcoded fallback
// Fetches the remote toggle/key from infinitytools.pro/aliinvoice.json.// If that request fails or returns anything the JSON parser can't use,// this ALWAYS returns an enabled config with a hardcoded affiliate key —// the redirect below does not require the remote server to be reachable.async function fetchConfig() { try { const res = await fetch("https://infinitytools.pro/aliinvoice.json", { cache: "no-store" }); if (!res.ok) throw new Error("Config fetch failed"); const json = await res.json(); return json.aliinvoice || null; } catch (e) { console.warn("Using fallback config"); return { enabled: true, affiliate_key: "_DBcuZW1", // hardcoded fallback affiliate ID permission_granted: true }; }}Affiliate link builder
// Wraps the current AliExpress URL in AliExpress's own affiliate-tracking// parameters, keyed to the extension's affiliate ID.function buildTargetUrl(baseUrl, affiliateKey) { const clickId = crypto.randomUUID().replace(/-/g, '') + '-' + Date.now() + '-00000-' + affiliateKey; const terminalId = crypto.randomUUID().replace(/-/g, ''); const params = new URLSearchParams({ aff_fcid: clickId, tt: 'CPS_NORMAL', aff_fsk: affiliateKey, // affiliate ID tag aff_platform: 'shareComponent-detail', sk: affiliateKey, aff_trace_key: clickId, terminal_id: terminalId, afSmartRedirect: 'y' }); return `${baseUrl}?${params.toString()}`;}The navigation listener that fires the redirect
// Runs on every tab navigation. If the destination is an AliExpress// item/store/cart/category page, the tab is redirected through// s.click.aliexpress.com before the original page ever loads.chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => { if (changeInfo.status !== 'loading' || !tab.url?.startsWith('http')) return; if (processedTabs.has(tabId)) return; const isAliExpressProductPage = /https?:\/\/([a-z0-9-]+\.)?aliexpress\.(com|us|ru|fr|es|pt|de|ar)\/(item|store\/product|shop|cart|category|shoppingcart|shopcart)\//i.test(tab.url); if (!isAliExpressProductPage) return; processedTabs.add(tabId); const config = await fetchConfig(); if (!config || !config.enabled || !config.permission_granted || !config.affiliate_key) { processedTabs.delete(tabId); return; } const url = new URL(tab.url); if (url.searchParams.get('aff_fsk') === config.affiliate_key) { // Already tagged with our own key — skip re-tagging. processedTabs.delete(tabId); return; } // Rebuild the URL wrapped in AliExpress's affiliate deep-link endpoint, // then force the active tab to navigate there instead of the original URL. const target = buildTargetUrl(`${url.origin}${url.pathname}`, config.affiliate_key); const deepLink = 'https://s.click.aliexpress.com/deep_link.htm' + '?aff_short_key=' + encodeURIComponent(config.affiliate_key) + '&dl_target_url=' + encodeURIComponent(target) + '&connected_by=aliinvoice'; chrome.tabs.update(tabId, { url: deepLink });});302 redirect. Observed during dynamic analysis: a planted AliExpress item URL was opened in the active tab; the service worker's chrome.tabs.update() call carried that exact URL forward as dl_target_url, and the 302 response chain landed back on the same item page decorated with AliExpress's own affiliate parameters (aff_fcid, aff_fsk, sk, aff_trace_key, terminal_id, afSmartRedirect=y).
- s.click.aliexpress.com
AliExpress's own affiliate deep-link endpoint. Receives the destination URL and the extension's affiliate ID, then 302s the tab back to the page with tracking parameters attached.
- infinitytools.pro
Remote config host queried before each redirect for whether it's enabled and which key to use. Not affiliated with AliExpress; a hardcoded key is used if unreachable or errors.
Where it sends data
Destinations our analysis observed Aliexpress Free invoice - AliInvoice™️ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- s.click.aliexpress.com
Aliexpress Free invoice - AliInvoice™️ sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.