Is AliExpress Image Search - AliCompare safe?
AliCompare opens a hidden AliExpress affiliate redirect tab when you reach checkout.
On AliExpress checkout confirmation pages, the extension immediately asks its background worker to open an inactive tab to an AliExpress affiliate redirect link and closes the tab after it loads. This action is throttled with local storage for about 15 minutes, and the observed data involved is the affiliate URL/tab event rather than checkout contents.
Who publishes italicompare.me - no other listings under this identity, 1 shared hostname
alicompare.me - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress Checkout Triggers Off-Screen Affiliate Redirect
At AliExpress checkout, the content script triggers a hidden tab to the extension's own affiliate link (s.click.aliexpress.com/e/_Dnnbq1Z), then closes it, overriding any existing affiliate tag so the extension becomes the referrer.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You reach the order-confirmation page during checkout on AliExpress.
The extension opens a hidden tab to its own AliExpress affiliate link, then closes it once loaded, placing itself as referrer just before your order completes.
No tab switch or notification appears; the whole sequence runs in the background service worker.
The content script and the background handler it triggers, from the extension's shipping source.
The checkout content script — runs only on the order-confirmation page
// manifest.json content_scripts match: https://*.aliexpress.com/p/trade/confirm.html*(() => { chrome.runtime.sendMessage({ cmd: "OPEN_AFF" });})();The message listener
chrome.runtime.onMessage.addListener((message, sender) => { switch (message.cmd) { case "BACKGROUND_START_MODAL": openImageSearchModal(sender.tab.id, message.data.srcUrl).catch(console.log); break; case "OPEN_AFF": openAffiliateTab().catch(console.log); }});openAffiliateTab() — the throttle-gated redirect
const AFF_THROTTLE_KEY = "LAST_AFF_OPEN";async function openAffiliateTab() { const lastOpened = (await chrome.storage.local.get([AFF_THROTTLE_KEY]))[AFF_THROTTLE_KEY]; if (Date.now() - lastOpened < 900000) return; // skip if under 15 minutes since the last redirect chrome.tabs.create({ active: false, url: "https://s.click.aliexpress.com/e/_Dnnbq1Z" }, (tab) => { chrome.tabs.onUpdated.addListener(function onLoaded(tabId, info) { if (info.status === "complete" && tabId === tab.id) { chrome.tabs.remove(tabId); chrome.tabs.onUpdated.removeListener(onLoaded); } }); chrome.storage.local.set({ [AFF_THROTTLE_KEY]: Date.now() }); });}Landing page of AliExpress's CPS (cost-per-sale) affiliate click-through flow (tt=CPS_NORMAL), the mechanism AliExpress uses for last-click commission attribution. Every affiliate parameter in the URL traces back to the extension's own short link (_Dnnbq1Z), not to whatever site or tag referred the shopper to AliExpress originally.
Timestamp set when the affiliate tab opens; checked before firing again, limiting redirects to once per 15 minutes.
- Location
- chrome.storage.local key LAST_AFF_OPEN
{ "LAST_AFF_OPEN": 1788013920000}- s.click.aliexpress.com
AliExpress's own affiliate short-link service. The extension's hardcoded link (/e/_Dnnbq1Z) opens in an inactive tab on every throttle-eligible checkout.
- aliexpress.com
The short link server-side redirects here, setting the extension's affiliate parameters as the referral credited for the order.
Hooks chrome.tabs.create in the extension's own service worker console and logs when it opens the affiliate-redirect tab, so you can watch the behavior fire in real time.
- Chrome with Developer mode enabled
(function() { const origCreate = chrome.tabs.create; chrome.tabs.create = function(props, cb) { if (props && props.url && props.url.includes('s.click.aliexpress.com')) { console.log('[AFF-WATCH] affiliate tab opened:', props.url, 'active=', props.active); } return origCreate.call(chrome.tabs, props, cb); }; console.log('[AFF-WATCH] installed. Visit an AliExpress order-confirmation page to trigger.');})();- 1Install it.
- 2In chrome://extensions (Developer mode), open AliCompare's service worker console.
- 3Paste this script into DevTools.
- 4Visit an order-confirmation page (aliexpress.com/p/trade/confirm.html); watch for [AFF-WATCH].
What it can do
Permissions this extension asks for, as declared in version 4.2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Add items to the right-click menu
contextMenus
Block and redirect the requests your browser makes
declarativeNetRequest
Read and change cookies, including the ones that keep you signed in
cookies
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Where it sends data
Destinations our analysis observed AliExpress Image Search - AliCompare contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- s.click.aliexpress.com
AliExpress Image Search - AliCompare sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.