Is AiPrice(AliPrice) Search by Image for TB safe?

Medium risk

AliPrice is medium risk. Each install/update, AliPrice's worker resets analytics consent to true, even after opt-out. Defaults set privacyConsentRequired false, privacyStatus true, so analytics start before any prompt. DA confirmed five set calls at first run.

aiprice3v5.0.7Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM

ClassMALICIOUS

TypeUnexpected

CWECWE-359

SourceAI SANDBOX

Analytics consent reset to opted-in on every extension update

Each install/update, AliPrice's worker resets analytics consent to true, even after opt-out.

Defaults set privacyConsentRequired false, privacyStatus true, so analytics start before any prompt.

DA confirmed five set calls at first run.

01EvidenceCAUSE EFFECT

What actually happens

You did this

AliPrice is installed or receives a Chrome auto-update.

browser.runtime.onInstalled fires with reason 'install' or 'update'.

The extension did this

The background worker resets the analytics consent flag to true, even if you had previously opted out.

Any prior privacyStatus=false value in storage is discarded before settings are persisted.

02EvidenceCODE COMPARE

The code that does this

Settings initialization, consent flag forced to true

What it actually does

Show shipped source

Default settings object — background.js:31728–31734assets/js/background.js

const defaultSettings = () => ({
  privacyConsentRequired: false,   // no consent prompt shown
  privacyStatus: true,             // analytics opted in by default
  privacyItemCookiesStatus: true,
  privacyItemFunctionalStatus: true,
  hasPrivacyPromptShowedOnInstall: false,
  ...
});

03EvidenceCAUSE EFFECT

What actually happens

You did this

You open the extension options and disable analytics.

The settings UI writes privacyStatus=false to chrome.storage.local.

The extension did this

On the next extension update, the background worker sets privacyStatus back to true before saving settings.

The opt-out is present in the merged settings object but is overwritten at background.js:15856 before being persisted.

04EvidenceCODE COMPARE

The code that does this

Analytics gate, privacyStatus controls whether data is sent

What it actually does

Show shipped source

Interpretationassets/js/background.js

// privacyStatus=true → sendToAlipriceAnalyze() + sendToAlipriceStatistics() + sendToGoogle()
// privacyStatus=false → none of these fire
// Because privacyStatus is reset to true on every update,
// analytics resume automatically after each Chrome auto-update.

05EvidenceTHIRD PARTY LIST

Analytics destinations that receive data when privacyStatus=true

matomo.chnprice.com
AliPrice's self-hosted Matomo analytics instance; receives browsing-activity events.
region1.google-analytics.com
Google Analytics (GA4); receives extension-activity events alongside Matomo.
api.aiprice.com
AliPrice API server; receives product-lookup and search activity.