Is Alitools Shopping Assistant safe?

High risk

Alitools Shopping Assistant sends every page URL you load to a remote server and runs the code it replies with.

After each page finishes loading, the extension injects a small script that reports the page address to an endpoint named in its remote configuration, along with the extension ID. The server's reply is decoded and run as JavaScript inside that page. This applies to all http(s) sites, not only supported shops, except domains on a remote exclusion list.

shoppingv22.1.3.13106Firefox Add-ons
80Risk
Who publishes it

shopping - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
shopping
Website
alitools.io

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliTools runs server-supplied code in every web page you finish loading

Code analysis shows each loaded page's URL is sent to a configured server, and the base64 reply is run as JavaScript in that page through an indirectly named Function call.

Gated by remote config.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You finish loading any web page that is not on the remote blocklist.

The extension did this

The extension adds a stub to the page that reports its URL and runs any encoded script the server sends back.

Whether a script is returned depends on the server.

The code that does this

Injected stub: reply is decoded and executed

Readable version
In r(a): payload = atob(a); ctor = payload['constructor'] (String); the check 'startup'['constructor'] === ctor passes for any string; then ctor['constructor'] is Function, so Function(payload) is built and passed to new Promise(). Function(payload) is the same as eval-style execution of the decoded text in the page's context.
Request sent for each page
  • Page address
    https://example.com/account/orders?id=88213

    The full address of the page you just opened, including any query string.

  • Extension ID
    amo-2737494

    Identifies which install family is reporting.

Remote services involved
    • cnf-u45p-alitools.com

    Serves the config that sets statsTask4Url, the blocklist and the on/off flag.

    • statsTask4Url (value from config)

    Receives the page URL and returns the base64 payload that is executed.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

AliTools sends the URL of every page you load to a remotely configured server

Code analysis shows the full URL of each finished page load is POSTed with the extension ID to an endpoint set by remote config.

It covers all http(s) sites, not only supported shops.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page, shopping or not.

The extension did this

The page address is sent to a server chosen by the extension's remote configuration.

What is sent per page load
  • Page address
    https://mail.example.org/inbox/thread/4471

    Shows which sites and pages you visit, in order.

  • Extension ID
    amo-2737494

    Ties the report to this extension install base.

The code that does this

Sender and tab listener

Readable version
On every completed tab load that passes isDisabled(), a stub posts the tab URL to the background, which POSTs it as JSON to the configured statsTask4Url with ?id=<runtime id> and returns the parsed reply.
Where the URL goes
    • cnf-u45p-alitools.com

    Config host that supplies statsTask4Url and the domain blocklist.

    • statsTask4Url (value from config)

    Receives each page URL with the extension ID.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 22.1.3.13106. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Show you desktop notifications

    notifications

  • See the address and title of every tab you have open

    tabs

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Alitools Shopping Assistant contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • cnf-u45p-alitools.com

    Alitools Shopping Assistant sends data to cnf-u45p-alitools.com. One other extension we have analysed sends data here.

Updated 15 October 2026amo-2737494