Is AliSave Plus - Download AliExpress Images safe?

High risk

AliSave Plus is high risk. Opening an AliExpress or Alibaba product page makes the background worker send the product ID and hostname to imgvidcfig.com, unrelated to AliExpress, Alibaba, or their affiliate network. Confirmed via two POSTs to imgvidcfig.com/api/gps.

alisaveplus.comv3.0.27Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliSave Plus sends every AliExpress product page you view to a third party

Opening an AliExpress or Alibaba product page makes the background worker send the product ID and hostname to imgvidcfig.com, unrelated to AliExpress, Alibaba, or their affiliate network.

Confirmed via two POSTs to imgvidcfig.com/api/gps.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open a product page on AliExpress or Alibaba; the site AliSave Plus is built to help you shop on.

No interaction with the extension itself is required; simply loading the page is enough.

The extension did this

The extension's background service worker sends that product's ID and the site's hostname to imgvidcfig.com, a domain unrelated to AliExpress or Alibaba.

This happens on every distinct product you view, independent of whether you ever use the extension's image/video download feature.

Captured request
POSThttps://imgvidcfig.com/api/gps

HTTP 200. Reproduced on a second, independent product visit (uuid=1005012249726779) with the same header shape.

Headers
uuid
1005003391567749
uhost
www.aliexpress.com
source
aliexpress
content-type
application/json
Fields sent to imgvidcfig.com on every product-page visit
  • Product ID
    1005003391567749

    The numeric ID of the exact product listing you're viewing, parsed from the page URL.

  • Site hostname
    www.aliexpress.com

    The hostname of the site you're browsing, e.g. which AliExpress or Alibaba regional storefront you used.

  • Source marketplace
    aliexpress

    Which of the two supported marketplaces (AliExpress or Alibaba) the product belongs to.

The code that does this

Product-page detection and outbound POST, background.js

Readable version
var reportedIds = {}, inFlight = [];var API_BASE = "https://imgvidcfig.com/api";async function reportProductView(productId, hostname) {  if (Object.keys(reportedIds).find(id => id === productId)) return; // already reported  const url = `${API_BASE}/gps`;  const res = await httpClient({    method: "POST",    url,    headers: {      "content-type": "application/json",      source: hostname.includes("aliexpress") ? "aliexpress" : "alibaba",      uhost: hostname,      uuid: productId    }  });  // response may carry a 'keepurl' header the extension caches for later redirect use}chrome.webRequest.onBeforeRequest.addListener((details) => {  try {    const navUrl = new URL(details.url);    if (isAliExpressProductPage(details.url) || isAlibabaProductPage(details.url)) {      const productId = extractProductId(details.url);      if (inFlight.includes(productId)) return; // 5s dedup window      inFlight.push(productId);      reportProductView(productId, navUrl.host);      setTimeout(() => { inFlight = inFlight.filter(id => id !== productId); }, 5000);    }  } catch (e) {}}, { urls: ["<all_urls>"], types: ["main_frame"] });
When this fires

When a batch threshold is hit

Fires once per distinct product ID per navigation. A 5-second in-memory dedup list suppresses repeat reports for the same product ID fired in quick succession, but a new report is sent the next time you land on that same product page after the window expires.

Destination server
    • imgvidcfig.com

    Receives a POST with the product ID and hostname for every AliExpress/Alibaba page visited. Not an AliExpress, Alibaba, or Alimama domain; no ownership disclosure in the listing.

Updated 30 September 2026ppfoibjbcchcfifclhebkhnigneiceje