Is AutoDS - Dropshipping Helper safe?
AutoDS - Dropshipping Helper intercepts XHR traffic and request headers on supplier sites and sends AliExpress product URLs to a third-party server for affiliate link rewriting.
The extension monkey-patches XMLHttpRequest on multiple supplier sites (AliExpress, Walmart, Kmart, Redbubble) to capture request and response data including product details and addresses. On Walmart, it captures authentication request headers and replays them in automated API calls. AliExpress product page URLs are transmitted to a Supabase-hosted endpoint where they are rewritten as affiliate links before the user is redirected.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AutoDS catalogs Shopify stores from page response headers
AutoDS checks response headers on each top-level page load to detect Shopify stores.
If a response has a Shopify marker header, the extension records that hostname locally, building a browsing-derived catalog of Shopify supplier sites.
You open a website in the browser.
The extension has host access for all URLs and listens to top-level page responses.
The extension checks the page response headers and stores the hostname when it sees a Shopify marker.
The stored key uses the site hostname, so repeated browsing can build a local list of detected Shopify supplier sites.
| Field | Value | Why it matters | |
|---|---|---|---|
Visited hostname | allbirds.com (illustrative) | This identifies the website that was detected as a Shopify store during your browsing. | |
Shopify-store flag | isShopifySupplier_allbirds.com: true (illustrative) | This records that the visited site returned a Shopify marker, adding context about the type of site you visited. | |
Browsing-derived catalog | isShopifySupplier_gymshark.com: true (illustrative) | Multiple stored keys can reveal a list of Shopify supplier or shopping sites visited from the browser profile. |
Per-site record of Shopify-hosted pages detected while browsing. Hostnames shown are illustrative examples of the key format.
chrome.storage.local keys named isShopifySupplier_<hostname>{
"isShopifySupplier_allbirds.com": true,
"isShopifySupplier_gymshark.com": true
}Response-header listener and local-storage write path
const m = e => new Promise((t => {
try {
chrome.storage.local.get(e, (n => t(null == n ? void 0 : n[e])))
} catch (e) {
v(e.message)
}
})),
b = e => t()(e, ((e, t) => {
try {
return chrome.storage.local.set({
[t]: e
})
} catch (e) {
v(e.message)
}
}));chrome.webRequest.onHeadersReceived.addListener((function(e) {
const t = e.responseHeaders.some((e => e.name.toLowerCase().includes("x-shopid")));
if (t) {
const {
hostname: n
} = new URL(e.url), r = `isShopifySupplier_${n}`;
b({
[r]: t
})
}
}), {
urls: ["<all_urls>"],
types: ["main_frame"]
}, ["responseHeaders"])