Is AutoDS - Dropshipping Helper safe?

Medium risk

AutoDS - Dropshipping Helper intercepts XHR traffic and request headers on supplier sites and sends AliExpress product URLs to a third-party server for affiliate link rewriting.

The extension monkey-patches XMLHttpRequest on multiple supplier sites (AliExpress, Walmart, Kmart, Redbubble) to capture request and response data including product details and addresses. On Walmart, it captures authentication request headers and replays them in automated API calls. AliExpress product page URLs are transmitted to a Supabase-hosted endpoint where they are rewritten as affiliate links before the user is redirected.

AutoDSv1.94.3Chrome Web Store
48Risk
Who publishes it

AutoDS LTD - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AutoDS
Declared legal entity
AutoDS LTD
Registered address
3601 walnut st, Denver, CO 80205, US
Registered contact
Michael Royf
Website
help.autods.com

Same store account

2 other listings published from this account, 7k+ users between them, none of them carrying a finding.

AutoDS eBay Manual Dropshipping4k+LowMarketplace Dropshipping Helper3k+Clean

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

v2-api.autods.com
Also called by 2 other listings: Spot N Paste, Dropshipping Titans Marketplace
platform.autods.com
Also called by 4 other listings, including Shopify Store Spy - Shoper Spy - Shopify apps, DSers, Lister by Hustle Got Real

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AutoDS catalogs Shopify stores from page response headers

MediumunwantedCWE-200Dynamic sandbox

AutoDS checks response headers on each top-level page load to detect Shopify stores.

What actually happens

You did this

You open a website in the browser.

The extension has host access for all URLs and listens to top-level page responses.

The extension did this

The extension checks the page response headers and stores the hostname when it sees a Shopify marker.

The stored key uses the site hostname, so repeated browsing can build a local list of detected Shopify supplier sites.

Fields recorded when a Shopify response marker is present

  • Visited hostname
    allbirds.com (illustrative)

    This identifies the website that was detected as a Shopify store during your browsing.

  • Shopify-store flag
    isShopifySupplier_allbirds.com: true (illustrative)

    This records that the visited site returned a Shopify marker, adding context about the type of site you visited.

  • Browsing-derived catalog
    isShopifySupplier_gymshark.com: true (illustrative)

    Multiple stored keys can reveal a list of Shopify supplier or shopping sites visited from the browser profile.

What's stored on your device

Per-site record of Shopify-hosted pages detected while browsing. Hostnames shown are illustrative examples of the key format.

Location
chrome.storage.local keys named isShopifySupplier_<hostname>
Contents
{  "isShopifySupplier_allbirds.com": true,  "isShopifySupplier_gymshark.com": true}

The code that does this

Response-header listener and local-storage write path

Readable version

Storage helper in the formatted service worker

background.bundle.js
const m = e => new Promise((t => {    try {      chrome.storage.local.get(e, (n => t(null == n ? void 0 : n[e])))    } catch (e) {      v(e.message)    }  })),  b = e => t()(e, ((e, t) => {    try {      return chrome.storage.local.set({        [t]: e      })    } catch (e) {      v(e.message)    }  }));

Formatted listener from the shipped service worker

background.bundle.js
chrome.webRequest.onHeadersReceived.addListener((function(e) {  const t = e.responseHeaders.some((e => e.name.toLowerCase().includes("x-shopid")));  if (t) {    const {      hostname: n    } = new URL(e.url), r = `isShopifySupplier_${n}`;    b({      [r]: t    })  }}), {  urls: ["<all_urls>"],  types: ["main_frame"]}, ["responseHeaders"])

What it can do

Permissions this extension asks for, as declared in version 1.93.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.94.3, which we have not unpacked yet.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Watch every request your browser makes

    webRequest

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Block and redirect the requests your browser makes

    declarativeNetRequest

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed AutoDS Dropshipping Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mnvyiwcmijptwjvpdwco.supabase.co

    AutoDS Dropshipping Extension sends data to mnvyiwcmijptwjvpdwco.supabase.co. No other extension we have analyzed sends data here.

Updated 30 September 2026inblpolgchbcgmocpnalobjmmaldkjap