Is AliFast - Download Ali Images & Videos safe?

Medium risk

AliFast sends AliExpress and Alibaba product URLs to alisave.info and redirects tabs to returned affiliate links.

When you open matching AliExpress or Alibaba product pages, AliFast checks its local referral permission flag. If that flag is unset or false, it posts the page URL and site type to alisave.info and redirects the tab to the affiliate URL returned by that service.

alisave.infov3.5.3Chrome Web Store
48Risk
Who publishes it

alisave.info - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
alisave.info
Declared legal entity
alisave.info
Registered address
3921 Walnut Ave, Fremont, CA 94538, US
Registered contact
Louis Palumbo

Same store account

2 other listings published from this account, 11k+ users between them. 2 of them carry a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliFast reroutes AliExpress pages through an affiliate link after you decline

Choosing Not Now on the referral consent dialog stores permissionGranted=false, the exact value that enables a second redirect path.

Dynamic analysis captured the product URL POSTed to alisave.info and the tab loading the link returned.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You decline the referral request by pressing Not Now, then open an AliExpress or Alibaba product page.

Not Now stores permissionGranted=false rather than leaving the value unset.

The extension did this

The background worker sends the product URL you are viewing to the vendor's server and moves your tab to the affiliate link that comes back.

The check reads if the stored consent value is truthy and returns early, so declining is the state in which this path runs.

The code that does this

The consent path and the redirect path read the same flag in opposite directions

Readable version

The same background block with the string table resolved

background.js
const AFFILIATE_API = 'https://alisave.info/wp-json/alisave/v1/get-affiliate';async function getLink(url, type) {  try {    const response = await fetch(AFFILIATE_API, {      method: 'POST',      headers: { 'Content-Type': 'application/json' },      body: JSON.stringify({ url, type })          // the product URL you are viewing    });    if (!response.ok) throw new Error('HTTP error! status: ' + response.status);    const data = await response.json();    if (!data.success || !data.affiliate_url) return url;    return data.affiliate_url;                     // server chooses the destination  } catch (err) { return url; }}chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  if (changeInfo.status !== 'loading') return;  if (!tab.url || processedTabs.has(tabId)) return;  const result = await chrome.storage.local.get(['permissionGranted']);  if (result.permissionGranted) return;            // runs ONLY when consent is false or unset  const urlCheck = checkUrl(tab.url);              // aliexpress /item/ or /store/product/, alibaba /product-detail/  if (!urlCheck.isAliExpress && !urlCheck.isAliBaba) return;  processedTabs.add(tabId);  try {    const type = urlCheck.isAliExpress ? 'aliexpress' : 'alibaba';    const cleanUrl = urlCheck.isAliBaba ? tab.url.split('?')[0] : tab.url;  // drops any existing query string    const newUrl = await getLink(cleanUrl, type);    if (newUrl !== cleanUrl) await chrome.tabs.update(tabId, { url: newUrl });  // tab is moved  } finally {    setTimeout(() => processedTabs.delete(tabId), 5000);  }});
Captured request
POSThttps://alisave.info/wp-json/alisave/v1/get-affiliate

Returned success with an affiliate_url whose aff_short_key was _DDBFVS9.

Headers
Content-Type
application/json
Body
{  "url": "https://www.aliexpress.com/item/1005006109476710.html",  "type": "aliexpress"}
Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DDBFVS9&dl_target_url=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109476710.html

The tab followed this link and landed back on the item page carrying aff_fsk=_DDBFVS9, sk=_DDBFVS9, aff_platform=portals-tool and an aff_trace_key.

Where the extension sends product URLs and where it sends your tab
    • alisave.info

    Vendor API. Receives the full product URL you are viewing and answers with the destination the tab is then moved to.

    • s.click.aliexpress.com

    AliExpress affiliate deep link service. The tab is routed through it with the vendor's aff_short_key attached.

    • acfe-vf2021.com

    Destination used by the Alibaba branch of the other redirect path, with the product URL passed in a ulp parameter.

    • docs.google.com

    Two published spreadsheets read at startup and every minute, supplying the affiliate key and an on/off switch for the extension.

What leaves the browser on each product page you open
  • The product page you are viewing
    https://www.aliexpress.com/item/1005006109476710.html

    The exact AliExpress or Alibaba listing you opened, sent before the page finishes loading.

  • Which marketplace
    aliexpress

    Tells the server whether to answer with an AliExpress or an Alibaba destination.

  • The link your tab is moved to
    https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DDBFVS9&dl_target_url=...

    The server picks where your browser goes next, so the destination is chosen remotely on every product page.

  • The referral key attached
    _DDBFVS9

    Rides on the page you land on, so the shopping session is attributed to the extension's owner.

What we did and did not observe

In a later session the vendor API answered 404 to every request, so the tab was not moved on that run. The behaviour is present in the shipped code and depends on the vendor's server, which chose the destination when it was answering.

What it can do

Permissions this extension asks for, as declared in version 3.5.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed AliFast - Download Ali Images & Videos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • alisave.info

    AliFast - Download Ali Images & Videos sends data to alisave.info. One other extension we have analysed sends data here.

Updated 30 September 2026lhdpiflflnaeicffammgiaabnlnldnjd