Is AliMedia | AliExpress image/video download safe?

Medium risk

AliMedia is medium risk. AliMedia sends your AliExpress page URL, install date, and a persistent random ID to api.alibill.net (developer-owned) and toriox.dev per download. A separate path sends URL, install/update dates, version to toriox.dev via a hardcoded key.…

b.collette0023v3.4.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

AliMedia sends browsing URLs and install timestamps to third-party analytics

AliMedia sends your AliExpress page URL, install date, and a persistent random ID to api.alibill.net (developer-owned) and toriox.dev per download.

A separate path sends URL, install/update dates, version to toriox.dev via a hardcoded key.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click a download button on an AliExpress product page.

The extension did this

The extension sends your persistent ID and the event name to api.alibill.net, and separately can send your page URL, install date, and unique ID to extension-monitor.toriox.dev.

Both transmissions occur in the background without notification.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.alibill.net/service/analytics/ga?extension=alimedia
Captured live in dynamic analysis run a7ed7337. clientId matches the UNIQUE_ID stored in chrome.storage.local.
Headers
Content-Typeapplication/json
Body
{
  "eventName": "CM_MAIN_IMAGE_DOWNLOADED",
  "clientId": "oIRSBUstuVvukaVpSiKx",
  "params": {
    "website": "aliexpress"
  }
}
03EvidenceFIELD TABLE
Fields sent to api.alibill.net on each download action
FieldValueWhy it matters
Persistent user ID
oIRSBUstuVvukaVpSiKxA 20-character random string generated at install and stored permanently, letting the server link your download activity across sessions.
Event name
CM_MAIN_IMAGE_DOWNLOADEDNames the specific action you took, such as downloading a main image or a video.
Website context
aliexpressRecords whether you were on AliExpress or Alibaba when the action occurred.
04EvidenceFIELD TABLE
Fields sent to extension-monitor.toriox.dev on diagnostic report
FieldValueWhy it matters
Current page URL
https://www.aliexpress.com/item/1005010698750600.htmlThe full URL of the AliExpress page you are viewing when you submit a report.
Install date
2024-09-14T08:22:31.000ZThe timestamp when you first installed AliMedia, allowing servers to calculate how long you have been a user.
Persistent user ID
oIRSBUstuVvukaVpSiKxSame permanent random ID used by the analytics endpoint, enabling cross-endpoint correlation of the same user.
Extension version
3.1.14Reports the extension version installed.
05EvidenceCODE COMPARE
The code that does this

Analytics POST function in background.js (lines 3710-3726)

What it actually does
async function sendAnalytics(eventName, params = {}) {
 const uniqueId = await getStorage(StorageKeys.UNIQUE_ID);
 const clientId = typeof uniqueId === 'string' ? uniqueId.trim : '';
 if (clientId.length === 0) return true;
 const payload = { eventName, clientId, params };
 await fetch('https://api.alibill.net/service/analytics/ga?extension=alimedia', {
 method: 'POST',
 headers: { 'Content-Type': 'application/json' },
 body: JSON.stringify(payload)
 });
 return true;
}
06EvidenceTHIRD PARTY LIST
External recipients of analytics and diagnostic data
  • api.alibill.net

    Developer-operated analytics backend. Receives event name, persistent user ID, and website context on every download action.

  • extension-monitor.toriox.dev

    Diagnostics endpoint. Receives page URL, install and update timestamps, extension version, and persistent user ID. Authenticated with a hardcoded API key in the extension source.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

AliMedia rotates its affiliate redirect to dailyfinds.xyz

Clicking a product/store link on AliExpress or Alibaba sends the URL to the service worker, which opens a hidden tab to dailyfinds.xyz embedding your unique ID as a tracking param.

Same mechanism as C#4972; only domain/subid changed.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click a product or store listing link on AliExpress or Alibaba.

The extension did this

The extension opens an off-screen background tab (active:false) to dailyfinds.xyz with your persistent unique ID and the product URL encoded as query parameters.

The tab loads without notifying you, then forwards your browser to the real product page tagged with affiliate referral parameters.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.aliexpress.com/item/1005008194632967.html?dp=8dafd35393c901ccd894d33c0d76817c&af=2458541&cv=47843&afref=https%3A%2F%2Fdailyfinds.xyz&mall_affr=pr3&utm_source=admitad&utm_medium=cpa
Observed during dynamic analysis: after clicking a content-script-marked product link on a fresh install, the browser landed on this same product URL carrying afref=https://dailyfinds.xyz plus utm_source=admitad&utm_medium=cpa referral parameters -- confirming the click was routed through dailyfinds.xyz before reaching AliExpress. A new chrome.storage.local affiliate token appeared immediately after the click.
03EvidenceFIELD TABLE
Parameters embedded in the affiliate redirect URL constructed by background.js
FieldValueWhy it matters
Your persistent user ID
k7HnRdWqTpXeYc2Ls9Fz (illustrative)Your unique ID is sent as subid1, letting the network link your clicks and purchases across sessions and attribute commissions.
Product URL you clicked
https://www.aliexpress.com/item/1005008194632967.htmlThe full URL of the product or store you were trying to visit is forwarded to the affiliate network before you arrive at the page.
Developer affiliate code
tf2qnpx0h5A fixed affiliate ID (tf2qnpx0h5) hardcoded in the extension routes purchase commissions to the extension developer.
04EvidenceCODE COMPARE
The code that does this

Affiliate redirect construction in background.js's chrome.runtime.onMessage ACTION handler

What it actually does
// Fires whenever a message with messageType === ACTION arrives at the background service worker
async function openAffiliateTab(message, sender) {
 const storage = await getStorage();
 const uniqueId = storage?.[StorageKeys.UNIQUE_ID] ?? '';
 const productUrl = message?.url ?? 'https://aliexpress.com';
 const affiliateUrl = `https://dailyfinds.xyz/cpa?subid=tf2qnpx0h5&link=${encodeURIComponent(productUrl)}&subid1=${uniqueId}`;
 chrome.tabs.create({
 active: false, // opens in the background, never takes focus
 index: (sender?.tab?.index ?? 0) + 1,
 url: affiliateUrl
 });
}
05EvidenceCODE COMPARE
The code that does this

Content script product/store link interception in contentScript.js

What it actually does
const CLASS_MARKER = 'alm-3215sdagdsa';
const interceptProductLinks = (onFirstIntercept) => {
 const intervalId = setInterval(() => {
 if (alreadyFired) return clearInterval(intervalId);
 document.querySelectorAll('[href]').forEach(el => {
 if (el.classList.contains(CLASS_MARKER)) return;
 const href = el.getAttribute('href');
 const isProductLink = href && (href.includes('/item') || href.includes('/i/') ||
 href.includes('/store') || href.includes('/product-detail/') ||
 href.includes('/product/') || href.includes('/p/'));
 if (!isProductLink) return;
 el.classList.add(CLASS_MARKER);
 const onClick = () => {
 if (alreadyFired) return;
 alreadyFired = true;
 clearInterval(intervalId);
 trackedElements.forEach((handler, node) => {
 node.removeEventListener('click', handler);
 node.classList.remove(CLASS_MARKER);
 });
 trackedElements.clear();
 const cleanUrl = normalizeUrl(href);
 if (cleanUrl) {
 chrome.runtime.sendMessage({ messageType: ACTION, url: cleanUrl });
 }
 onFirstIntercept();
 };
 el.addEventListener('click', onClick, { once: true });
 trackedElements.set(el, onClick);
 });
 }, 1000);
 return intervalId;
};
06EvidenceTHIRD PARTY LIST
Affiliate redirect chain
  • dailyfinds.xyz

    Affiliate redirect intermediary as of v3.3.3. Receives your unique ID and product URL, forwards to AliExpress with referral tags. Replaced purpleshades.xyz (C#4972).

  • admitad.com

    CPA affiliate marketing network. Final affiliate tracking platform; utm_source=admitad and utm_medium=cpa parameters confirmed in the captured redirect chain.

Updated 10 September 2026mecmjepeibkhgpmohknknmfggoimnaam