Is AliSave - Download AliExpress Images safe?
AliSave redirects AliExpress product and cart pages through an AliExpress affiliate deep-link endpoint.
When an AliExpress item or cart page starts loading, the background service worker rewrites the active tab to s.click.aliexpress.com with the current page URL in the dl_target_url parameter. This sends the page URL and tab navigation context to the AliExpress affiliate redirect endpoint before the page continues.
Who publishes itAliTools Inc - 1 other listing from the same operator, 1 of them carrying a finding
AliTools Inc - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 1k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress Navigation Automatically Rerouted Through AliSave's Affiliate Link
Opening any AliExpress product, order, or cart page makes AliSave redirect your tab through its affiliate link, s.click.aliexpress.com/deep_link.htm, routed back carrying its tracking parameters, replacing attribution on 4 of 5 patterns.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open an AliExpress product, order, or shopping-cart page in the active tab.
AliSave intercepts the navigation before the page loads and redirects the tab through its own affiliate link, s.click.aliexpress.com/deep_link.htm, tagged with its affiliate ID.
This fires on every matching navigation, not only when you use AliSave's image or video download feature.
Three navigation listeners in background.bundle.js; two use a plaintext ID, one decodes at runtime.
Listener #1, renamed
// Runs on every navigation while the tab is loading.chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) { if (changeInfo.status !== 'loading') return; chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) { const activeTab = tabs[0]; const activeTabId = activeTab.id; const activeUrl = activeTab.url; const redirectUrl = 'https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_ATYX6R&dl_target_url=' + activeTab.url.split('?')[0]; const isTargetPage = activeUrl.match('aliexpress.com/item/') || activeUrl.match('aliexpress.ru/item/'); const alreadyRedirected = activeUrl.indexOf('_ATYX6R') !== -1; if (isTargetPage && !alreadyRedirected) { chrome.tabs.update(activeTabId, { url: redirectUrl }); } });});Listener #3, decoded
// Each byte array below decodes at runtime via u(), which subtracts each// byte from the matching character of a fixed 62-char cover string.// s (aff_short_key) -> "_DCvIfGB"// i (match string #1) -> "aliexpress.com/order/"// t (match string #2) -> "aliexpress.com/p/shoppingcart/"// o (match string #3) -> "aliexpress.ru/shopcart/"// r (redirect URL prefix) -> "https://s.click.aliexpress.com/deep_link.htm?aff_short_key="// d (redirect URL param) -> "&dl_target_url="chrome.tabs.onUpdated.addListener(async function (tabId, changeInfo) { const lastRun = (await getStorage('l')) || 0; const now = Date.now(); const affShortKey = '_DCvIfGB'; if (changeInfo.status !== 'loading') return; const activeTab = (await chrome.tabs.query({ active: true, currentWindow: true }))[0]; const activeTabId = activeTab && activeTab.id; const activeUrl = activeTab && activeTab.url; if (lastRun >= now) return; const matchesOrderOrCart = activeUrl && ( activeUrl.match('aliexpress.com/order/') || activeUrl.match('aliexpress.com/p/shoppingcart/') || activeUrl.match('aliexpress.ru/shopcart/') ); if (matchesOrderOrCart && activeUrl.indexOf(affShortKey) === -1) { await setStorage('l', now); const redirectUrl = 'https://s.click.aliexpress.com/deep_link.htm?aff_short_key=' + affShortKey + '&dl_target_url=' + activeUrl; chrome.tabs.update(activeTabId, { url: redirectUrl }); } // ...separate branch below handles item/ pages with per-item dedupe...});Listener #3's affiliate ID and match strings never appear as plaintext in the shipped file. They are stored as arrays of small signed integers and reconstructed at runtime by subtracting each byte from the matching character of a fixed 62-character string that also appears (unrelated) in the extension's image-download feature.
{ "s (aff_short_key)": "_DCvIfGB", "i (match string #1)": "aliexpress.com/order/", "t (match string #2)": "aliexpress.com/p/shoppingcart/", "o (match string #3)": "aliexpress.ru/shopcart/", "r (redirect URL prefix)": "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=", "d (redirect URL param)": "&dl_target_url="}302 redirect back to aliexpress.com. The landing URL carries aff_fsk=_ATYX6R, sk=_ATYX6R, and an aff_trace_key value assigned by AliExpress to this affiliate account, none of which were present on the original navigation.
- The product page you're viewinghttps://www.aliexpress.com/item/1005006109710354.html
The exact AliExpress item, order, or cart URL you navigated to, passed as a parameter to the extension's affiliate redirect.
- Chrome's internal tab identifier1585209825
Identifies which browser tab to rewrite, read via chrome.tabs.query before the redirect is issued.
- The extension's affiliate IDaff_short_key=_ATYX6R (plaintext) or _DCvIfGB (byte-array-encoded)
A fixed ID AliSave stamps on the redirect so AliExpress credits any purchase to AliSave. Same for every user; one copy is obfuscated.
- Tracking parameters on your return URLaff_fsk=_ATYX6R&sk=_ATYX6R&aff_trace_key=<AliExpress-assigned>
AliExpress echoes these back onto the page you land on after the redirect completes, confirming the purchase attribution.
- s.click.aliexpress.com
AliExpress's own affiliate deep-link redirector. Receives the product/cart URL and AliSave's ID on each matching navigation, attributing any purchase to AliSave's account.
What it can do
Permissions this extension asks for, as declared in version 5.10.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on aliexpress.com
*://*.aliexpress.com/
Read and change your data on aliexpress.ru
*://*.aliexpress.ru/
Read and change your data on aliexpress.us
*://*.aliexpress.us/
Read and change your data on alicdn.com
*://*.alicdn.com/
Read and change your data on aliexpress-media.com
*://*.aliexpress-media.com/
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Start, monitor and manage your downloads
downloads
Where it sends data
Destinations our analysis observed AliSave - Download AliExpress Images contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- s.click.aliexpress.com
AliSave - Download AliExpress Images sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.