Is AliPal – Download AliExpress & Alibaba Images and Videos in HD safe?

Medium risk

AliPal sends clicked AliExpress product URLs to dailyfinds.xyz through an affiliate redirect.

When you click AliExpress product links, the content script intercepts matching item links and asks the background worker to open an inactive affiliate tab. That request includes the original product URL as the link parameter to dailyfinds.xyz/cpa, so dailyfinds.xyz receives the item URL you clicked.

kiril.abdulovv3.1.7.2Chrome Web Store
46Risk
Who publishes it

kiril.abdulov - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
kiril.abdulov

Same store account

1 other listing published from this account, 20k+ users between them. 1 of them carries a finding.

alibill-%E2%80%93-aliexpress-invo20k+Medium

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

dailyfinds.xyz
Also called by 1 other listing: AliMedia
cors.alimedia.xyz
Also called by 4 other listings, including AliMedia, Ali Hunter - Aliexpress Dropshipping Center, AliDownloader

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress product clicks redirect through dailyfinds.xyz affiliate endpoint

When you click an AliExpress product link in AliPal, the extension intercepts the click and opens a dailyfinds.xyz affiliate URL in an inactive tab, including the clicked product URL. dailyfinds.xyz gets the item page you chose.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user clicks an AliExpress product link on an AliExpress or Alibaba page.

The extension did this

The extension opens a dailyfinds.xyz affiliate endpoint with the clicked product URL.

Captured request
GEThttps://dailyfinds.xyz/cpa
Fields in the request
  • Clicked product URL
    https://www.aliexpress.com/item/1005000000000000.html

    Shows the specific AliExpress item page the user selected.

What it can do

Permissions this extension asks for, as declared in version 3.1.7.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on alicdn.com

    *://*.alicdn.com/*

  • Read and change your data on cloud.video.taobao.com

    *://cloud.video.taobao.com/*

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/*

  • Read and change your data on aliexpress.ru

    *://*.aliexpress.ru/*

  • Read and change your data on aliexpress.us

    *://*.aliexpress.us/*

  • Read and change your data on www.google-analytics.com

    https://www.google-analytics.com/*

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

Where it sends data

Destinations our analysis observed AliPal – Download AliExpress & Alibaba Images and Videos in HD contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • dailyfinds.xyz

    AliPal – Download AliExpress & Alibaba Images and Videos in HD sends data to dailyfinds.xyz. No other extension we have analysed sends data here.

Updated 30 September 2026fbjaeeajhaabbhklcahocomhebojhade