Is AliSave - Download AliExpress Images safe?

Medium risk

AliSave redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.

When an AliExpress item or cart page starts loading, the background service worker rewrites the active tab to s.click.aliexpress.com with the current page URL in the dl_target_url parameter. This sends the page URL and tab navigation context to the AliExpress affiliate redirect endpoint before the page continues.

AliTools Incv5.10.1Chrome Web Store
45Risk
Who publishes it

AliTools Inc - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AliTools Inc

Same store account

1 other listing published from this account, 1k+ users between them. 1 of them carries a finding.

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

aliexpress-media.com
Also called by 1 other listing: Aliexpress image downloader

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress Navigation Automatically Rerouted Through AliSave's Affiliate Link

Opening any AliExpress product, order, or cart page makes AliSave redirect your tab through its affiliate link, s.click.aliexpress.com/deep_link.htm, routed back carrying its tracking parameters, replacing attribution on 4 of 5 patterns.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress product, order, or shopping-cart page in the active tab.

The extension did this

AliSave intercepts the navigation before the page loads and redirects the tab through its own affiliate link, s.click.aliexpress.com/deep_link.htm, tagged with its affiliate ID.

This fires on every matching navigation, not only when you use AliSave's image or video download feature.

The code that does this

Three navigation listeners in background.bundle.js; two use a plaintext ID, one decodes at runtime.

Readable version

Listener #1, renamed

// Runs on every navigation while the tab is loading.chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {  if (changeInfo.status !== 'loading') return;  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {    const activeTab = tabs[0];    const activeTabId = activeTab.id;    const activeUrl = activeTab.url;    const redirectUrl = 'https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_ATYX6R&dl_target_url=' + activeTab.url.split('?')[0];    const isTargetPage = activeUrl.match('aliexpress.com/item/') || activeUrl.match('aliexpress.ru/item/');    const alreadyRedirected = activeUrl.indexOf('_ATYX6R') !== -1;    if (isTargetPage && !alreadyRedirected) {      chrome.tabs.update(activeTabId, { url: redirectUrl });    }  });});

Listener #3, decoded

// Each byte array below decodes at runtime via u(), which subtracts each// byte from the matching character of a fixed 62-char cover string.// s  (aff_short_key)       -> "_DCvIfGB"// i  (match string #1)      -> "aliexpress.com/order/"// t  (match string #2)      -> "aliexpress.com/p/shoppingcart/"// o  (match string #3)      -> "aliexpress.ru/shopcart/"// r  (redirect URL prefix)  -> "https://s.click.aliexpress.com/deep_link.htm?aff_short_key="// d  (redirect URL param)   -> "&dl_target_url="chrome.tabs.onUpdated.addListener(async function (tabId, changeInfo) {  const lastRun = (await getStorage('l')) || 0;  const now = Date.now();  const affShortKey = '_DCvIfGB';  if (changeInfo.status !== 'loading') return;  const activeTab = (await chrome.tabs.query({ active: true, currentWindow: true }))[0];  const activeTabId = activeTab && activeTab.id;  const activeUrl = activeTab && activeTab.url;  if (lastRun >= now) return;  const matchesOrderOrCart = activeUrl && (    activeUrl.match('aliexpress.com/order/') ||    activeUrl.match('aliexpress.com/p/shoppingcart/') ||    activeUrl.match('aliexpress.ru/shopcart/')  );  if (matchesOrderOrCart && activeUrl.indexOf(affShortKey) === -1) {    await setStorage('l', now);    const redirectUrl = 'https://s.click.aliexpress.com/deep_link.htm?aff_short_key=' + affShortKey + '&dl_target_url=' + activeUrl;    chrome.tabs.update(activeTabId, { url: redirectUrl });  }  // ...separate branch below handles item/ pages with per-item dedupe...});
Why you can't catch this in DevTools

Listener #3's affiliate ID and match strings never appear as plaintext in the shipped file. They are stored as arrays of small signed integers and reconstructed at runtime by subtracting each byte from the matching character of a fixed 62-character string that also appears (unrelated) in the extension's image-download feature.

Decoded value
{  "s (aff_short_key)": "_DCvIfGB",  "i (match string #1)": "aliexpress.com/order/",  "t (match string #2)": "aliexpress.com/p/shoppingcart/",  "o (match string #3)": "aliexpress.ru/shopcart/",  "r (redirect URL prefix)": "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=",  "d (redirect URL param)": "&dl_target_url="}
Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_ATYX6R&dl_target_url=https://www.aliexpress.com/item/1005006109710354.html

302 redirect back to aliexpress.com. The landing URL carries aff_fsk=_ATYX6R, sk=_ATYX6R, and an aff_trace_key value assigned by AliExpress to this affiliate account, none of which were present on the original navigation.

What the redirect carries out, and what comes back
  • The product page you're viewing
    https://www.aliexpress.com/item/1005006109710354.html

    The exact AliExpress item, order, or cart URL you navigated to, passed as a parameter to the extension's affiliate redirect.

  • Chrome's internal tab identifier
    1585209825

    Identifies which browser tab to rewrite, read via chrome.tabs.query before the redirect is issued.

  • The extension's affiliate ID
    aff_short_key=_ATYX6R (plaintext) or _DCvIfGB (byte-array-encoded)

    A fixed ID AliSave stamps on the redirect so AliExpress credits any purchase to AliSave. Same for every user; one copy is obfuscated.

  • Tracking parameters on your return URL
    aff_fsk=_ATYX6R&sk=_ATYX6R&aff_trace_key=<AliExpress-assigned>

    AliExpress echoes these back onto the page you land on after the redirect completes, confirming the purchase attribution.

Where the redirect goes
    • s.click.aliexpress.com

    AliExpress's own affiliate deep-link redirector. Receives the product/cart URL and AliSave's ID on each matching navigation, attributing any purchase to AliSave's account.

What it can do

Permissions this extension asks for, as declared in version 5.10.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/

  • Read and change your data on aliexpress.ru

    *://*.aliexpress.ru/

  • Read and change your data on aliexpress.us

    *://*.aliexpress.us/

  • Read and change your data on alicdn.com

    *://*.alicdn.com/

  • Read and change your data on aliexpress-media.com

    *://*.aliexpress-media.com/

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Start, monitor and manage your downloads

    downloads

Where it sends data

Destinations our analysis observed AliSave - Download AliExpress Images contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    AliSave - Download AliExpress Images sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

Updated 30 September 2026podfioikdpcdineeanolnffpnfmklbod