Is AliFast - Download Ali Images & Videos safe?
AliFast sends AliExpress and Alibaba product URLs to alisave.info and redirects tabs to returned affiliate links.
When you open matching AliExpress or Alibaba product pages, AliFast checks its local referral permission flag. If that flag is unset or false, it posts the page URL and site type to alisave.info and redirects the tab to the affiliate URL returned by that service.
Who publishes italisave.info - 2 other listings from the same operator, 2 of them carrying a finding
alisave.info - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 11k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliFast reroutes AliExpress pages through an affiliate link after you decline
Choosing Not Now on the referral consent dialog stores permissionGranted=false, the exact value that enables a second redirect path.
Dynamic analysis captured the product URL POSTed to alisave.info and the tab loading the link returned.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You decline the referral request by pressing Not Now, then open an AliExpress or Alibaba product page.
Not Now stores permissionGranted=false rather than leaving the value unset.
The background worker sends the product URL you are viewing to the vendor's server and moves your tab to the affiliate link that comes back.
The check reads if the stored consent value is truthy and returns early, so declining is the state in which this path runs.
The consent path and the redirect path read the same flag in opposite directions
The same background block with the string table resolved
background.jsconst AFFILIATE_API = 'https://alisave.info/wp-json/alisave/v1/get-affiliate';async function getLink(url, type) { try { const response = await fetch(AFFILIATE_API, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ url, type }) // the product URL you are viewing }); if (!response.ok) throw new Error('HTTP error! status: ' + response.status); const data = await response.json(); if (!data.success || !data.affiliate_url) return url; return data.affiliate_url; // server chooses the destination } catch (err) { return url; }}chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => { if (changeInfo.status !== 'loading') return; if (!tab.url || processedTabs.has(tabId)) return; const result = await chrome.storage.local.get(['permissionGranted']); if (result.permissionGranted) return; // runs ONLY when consent is false or unset const urlCheck = checkUrl(tab.url); // aliexpress /item/ or /store/product/, alibaba /product-detail/ if (!urlCheck.isAliExpress && !urlCheck.isAliBaba) return; processedTabs.add(tabId); try { const type = urlCheck.isAliExpress ? 'aliexpress' : 'alibaba'; const cleanUrl = urlCheck.isAliBaba ? tab.url.split('?')[0] : tab.url; // drops any existing query string const newUrl = await getLink(cleanUrl, type); if (newUrl !== cleanUrl) await chrome.tabs.update(tabId, { url: newUrl }); // tab is moved } finally { setTimeout(() => processedTabs.delete(tabId), 5000); }});Returned success with an affiliate_url whose aff_short_key was _DDBFVS9.
- Content-Type
- application/json
{ "url": "https://www.aliexpress.com/item/1005006109476710.html", "type": "aliexpress"}The tab followed this link and landed back on the item page carrying aff_fsk=_DDBFVS9, sk=_DDBFVS9, aff_platform=portals-tool and an aff_trace_key.
- alisave.info
Vendor API. Receives the full product URL you are viewing and answers with the destination the tab is then moved to.
- s.click.aliexpress.com
AliExpress affiliate deep link service. The tab is routed through it with the vendor's aff_short_key attached.
- acfe-vf2021.com
Destination used by the Alibaba branch of the other redirect path, with the product URL passed in a ulp parameter.
- docs.google.com
Two published spreadsheets read at startup and every minute, supplying the affiliate key and an on/off switch for the extension.
- The product page you are viewinghttps://www.aliexpress.com/item/1005006109476710.html
The exact AliExpress or Alibaba listing you opened, sent before the page finishes loading.
- Which marketplacealiexpress
Tells the server whether to answer with an AliExpress or an Alibaba destination.
- The link your tab is moved tohttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DDBFVS9&dl_target_url=...
The server picks where your browser goes next, so the destination is chosen remotely on every product page.
- The referral key attached_DDBFVS9
Rides on the page you land on, so the shopping session is attributed to the extension's owner.
In a later session the vendor API answered 404 to every request, so the tab was not moved on that run. The behaviour is present in the shipped code and depends on the vendor's server, which chose the destination when it was answering.
What it can do
Permissions this extension asks for, as declared in version 3.5.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Start, monitor and manage your downloads
downloads
See the address and title of every tab you have open
tabs
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed AliFast - Download Ali Images & Videos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- alisave.info
AliFast - Download Ali Images & Videos sends data to alisave.info. One other extension we have analysed sends data here.