Is AliExpress Invoice Creator safe?
AliExpress Invoice Creator is medium risk. AliExpress Invoice Creator is a PDF invoice tool. It also loads a script on non-login aliexpress.com pages that, once daily, redirects your tab through alitems.co, landing on best.aliexpress.com with admitad/cpa params, undisclosed.
Who publishes itYesButNoThis Team - no other listings under this identity, 1 shared hostname
YesButNoThis Team - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
First Daily AliExpress Visit Redirected to an Affiliate Gateway
AliExpress Invoice Creator is a PDF invoice tool.
It also loads a script on non-login aliexpress.com pages that, once daily, redirects your tab through alitems.co, landing on best.aliexpress.com with admitad/cpa params, undisclosed.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open any AliExpress page (other than a login page) for the first time that day.
The extension's stated purpose is generating a printable PDF invoice from your AliExpress orders.
The extension redirects your active tab away from AliExpress, through an affiliate gateway, and back to AliExpress.
The redirect happens before you interact with any invoice feature, just loading the page is enough.
On every browser startup
The redirect only fires on the first qualifying AliExpress page load of each calendar day. Once the stored marker is refreshed, later page loads that same day pass the check without triggering another redirect, until the date rolls over.
Content script shipped in assets/js/extra.js, not minified or obfuscated: code as distributed.
// Same file — the extension ships this logic in the clear, no build step// or obfuscator involved. Annotated for clarity:window.onload = () => { // Skip AliExpress login pages if (!window.location.href.includes("login")) { chrome.storage.sync.get(null, (storage) => { const todayMarker = new Date().toDateString() + "--2315"; // fixed campaign suffix if (storage?.flag) { // Marker exists: has today already been "used"? if (storage.flag !== todayMarker) { // First qualifying page load today — arm the marker, then redirect chrome.storage.sync.set({ flag: todayMarker }, () => { window.location.href = "https://alitems.co/g/1e8d114494b450bf195016525dc3e8/?ulp="; }); } // else: already redirected once today, do nothing further } else { // First install / first run: seed the marker but don't redirect yet chrome.storage.sync.set({ flag: todayMarker }, () => {}); } }); }};302 redirect chain: alitems.co → s.click.aliexpress.com/deep_link.htm → best.aliexpress.com, landing URL carrying af=1645653, cv=47843, utm_source=admitad, utm_medium=cpa.
- alitems.co
First hop of the redirect. This domain is the entry point for an affiliate-link program; it is not part of AliExpress or Alibaba Group.
- s.click.aliexpress.com
AliExpress's own affiliate deep-link redirector. Second hop in the chain, forwards to the final landing page with the affiliate parameters attached.
- best.aliexpress.com
Final landing page. The URL carries admitad/cpa parameters (af=1645653, cv=47843, utm_source=admitad), attributing any purchase this session to the account behind alitems.co.
What it can do
Permissions this extension asks for, as declared in version 1.1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on aliexpress.com
*://*.aliexpress.com/*
Store data in your browser
storage
Start, monitor and manage your downloads
downloads