Is AliSave Plus - Download AliExpress Images safe?
AliSave Plus is high risk. Opening an AliExpress or Alibaba product page makes the background worker send the product ID and hostname to imgvidcfig.com, unrelated to AliExpress, Alibaba, or their affiliate network. Confirmed via two POSTs to imgvidcfig.com/api/gps.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliSave Plus sends every AliExpress product page you view to a third party
Opening an AliExpress or Alibaba product page makes the background worker send the product ID and hostname to imgvidcfig.com, unrelated to AliExpress, Alibaba, or their affiliate network.
Confirmed via two POSTs to imgvidcfig.com/api/gps.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open a product page on AliExpress or Alibaba; the site AliSave Plus is built to help you shop on.
No interaction with the extension itself is required; simply loading the page is enough.
The extension's background service worker sends that product's ID and the site's hostname to imgvidcfig.com, a domain unrelated to AliExpress or Alibaba.
This happens on every distinct product you view, independent of whether you ever use the extension's image/video download feature.
HTTP 200. Reproduced on a second, independent product visit (uuid=1005012249726779) with the same header shape.
- uuid
- 1005003391567749
- uhost
- www.aliexpress.com
- source
- aliexpress
- content-type
- application/json
- Product ID1005003391567749
The numeric ID of the exact product listing you're viewing, parsed from the page URL.
- Site hostnamewww.aliexpress.com
The hostname of the site you're browsing, e.g. which AliExpress or Alibaba regional storefront you used.
- Source marketplacealiexpress
Which of the two supported marketplaces (AliExpress or Alibaba) the product belongs to.
Product-page detection and outbound POST, background.js
var reportedIds = {}, inFlight = [];var API_BASE = "https://imgvidcfig.com/api";async function reportProductView(productId, hostname) { if (Object.keys(reportedIds).find(id => id === productId)) return; // already reported const url = `${API_BASE}/gps`; const res = await httpClient({ method: "POST", url, headers: { "content-type": "application/json", source: hostname.includes("aliexpress") ? "aliexpress" : "alibaba", uhost: hostname, uuid: productId } }); // response may carry a 'keepurl' header the extension caches for later redirect use}chrome.webRequest.onBeforeRequest.addListener((details) => { try { const navUrl = new URL(details.url); if (isAliExpressProductPage(details.url) || isAlibabaProductPage(details.url)) { const productId = extractProductId(details.url); if (inFlight.includes(productId)) return; // 5s dedup window inFlight.push(productId); reportProductView(productId, navUrl.host); setTimeout(() => { inFlight = inFlight.filter(id => id !== productId); }, 5000); } } catch (e) {}}, { urls: ["<all_urls>"], types: ["main_frame"] });When a batch threshold is hit
Fires once per distinct product ID per navigation. A 5-second in-memory dedup list suppresses repeat reports for the same product ID fired in quick succession, but a new report is sent the next time you land on that same product page after the window expires.
- imgvidcfig.com
Receives a POST with the product ID and hostname for every AliExpress/Alibaba page visited. Not an AliExpress, Alibaba, or Alimama domain; no ownership disclosure in the listing.