Is AliSave Pro - AliExpress Image & Video Downloader safe?

Medium risk

AliSave Pro routes AliExpress product and cart pages through an affiliate deep link.

When AliExpress product or cart pages load, AliSave Pro rewrites the tab URL through an AliExpress affiliate deep-link endpoint. The rewritten URL includes the page address as the target and uses the extension's affiliate key before sending the browser to the destination.

AliTools Incv5.5.7Chrome Web Store
46Risk
Who publishes it

AliTools Inc - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AliTools Inc

Same store account

1 other listing published from this account, 2k+ users between them. 1 of them carries a finding.

AliSave - Download AliExpress Images2k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliSave Pro reroutes AliExpress product pages through its own affiliate link

Opening an AliExpress product or cart page makes AliSave Pro replace the tab with an affiliate deep link carrying the code _DBvwstl.

Dynamic analysis captured the rewrite and the redirect back with affiliate tracking attached.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress product page or your AliExpress shopping cart.

The page is still loading when the extension acts, so the redirect happens before you see the product.

The extension did this

The extension replaces your tab with an affiliate link to the same product carrying its own referral code.

The referral code _DBvwstl is attached, so any purchase you make is credited to the extension's operator.

Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DBvwstl&dl_target_url=https://www.aliexpress.com/item/1005006109458123.html

302 redirect back to the original product page, now carrying aff_fcid, aff_fsk, sk and aff_trace_key values minted for the _DBvwstl affiliate account.

What the rewritten URL carries
  • The referral code
    aff_short_key=_DBvwstl

    Identifies whose account gets paid the commission on anything you buy in that session.

  • The product you were opening
    dl_target_url=https://www.aliexpress.com/item/1005006109458123.html

    The exact page you asked for, passed on so the trip through the affiliate link is not obvious.

  • The commission token you come back with
    aff_fcid=f9c62e9135...-_DBvwstl&tt=CPS_NORMAL&sk=_DBvwstl

    Ties your later purchase back to the referral code that sent you.

  • Anything else that was on your link
    ?aff_trace_key=cwsprobe-incumbent-00 (removed)

    Whatever followed the question mark in your original link is dropped, including another site's referral credit.

The code that does this

The two navigation listeners in the service worker

Readable version

Listener A, readable

background.js
chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) {  if (changeInfo.status !== "loading") return;  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {    const activeTab = tabs[0];    const url = activeTab.url;    // the original query string is thrown away here    const deepLink =      "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DBvwstl" +      "&dl_target_url=" + url.split("?")[0];    const isProductPage =      url.match("aliexpress.com/item/") || url.match("aliexpress.ru/item/");    const alreadyTagged = url.indexOf("_DBvwstl") !== -1;    if (isProductPage && !alreadyTagged) {      chrome.tabs.update(activeTab.id, { url: deepLink });    }  });});

Listener B, readable

background.js
chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) {  if (changeInfo.status !== "loading") return;  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {    const activeTab = tabs[0];    const url = activeTab.url;    const deepLink =      "https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_DBvwstl" +      "&dl_target_url=" + url;    const inScope =      url.match("aliexpress.us/item/") ||      url.match("aliexpress.com/shopcart/") ||      url.match("aliexpress.ru/shopcart/");    if (inScope && url.indexOf("_DBvwstl") === -1) {      chrome.tabs.update(activeTab.id, { url: deepLink });    }  });});
Where the redirect sends you
    • s.click.aliexpress.com

    AliExpress affiliate deep link service. Records the referral code _DBvwstl and redirects you back to the product with commission tracking attached.

Check if you're affected

Follows the affiliate deep link the extension builds and prints the tracking parameters AliExpress attaches on the way back.

Requires
  • bash
  • curl
check-alisave-redirect.sh · sh
#!/usr/bin/env bash# Reproduce what AliSave Pro does to an AliExpress product URL.# Usage: ./check-alisave-redirect.sh https://www.aliexpress.com/item/1005006109458123.htmlset -euo pipefailTARGET="${1:?pass an AliExpress product URL}"BARE="${TARGET%%\?*}"                 # the extension drops everything after '?'AFF="_DBvwstl"DEEP="https://s.click.aliexpress.com/deep_link.htm?aff_short_key=${AFF}&dl_target_url=${BARE}"echo "you asked for : ${TARGET}"echo "extension sends: ${DEEP}"echoecho "--- redirect chain ---"curl -sSL -o /dev/null -w '%{http_code} %{url_effective}\n' \  --max-redirs 10 -A 'Mozilla/5.0' "${DEEP}"
How to run it
  1. 1Save the script and run chmod +x check-alisave-redirect.sh.
  2. 2Run it with an AliExpress product URL.
  3. 3Compare the final URL it prints with the plain product URL you started from.

What it can do

Permissions this extension asks for, as declared in version 5.5.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on alicdn.com

    *://*.alicdn.com/*

  • Read and change your data on cloud.video.taobao.com

    *://cloud.video.taobao.com/*

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/*

  • Read and change your data on aliexpress.ru

    *://*.aliexpress.ru/*

  • Start, monitor and manage your downloads

    downloads

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed AliSave Pro - AliExpress Image & Video Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    AliSave Pro - AliExpress Image & Video Downloader sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

Updated 30 September 2026hdfmghomeofikccjcdanfhggolojodig