Is Autofill Taobao Tracking No. & Shipping Info safe?

Medium risk

Autofill Taobao Tracking No. & Shipping Info records matched tab URLs and sends domains to AliPrice endpoints.

The extension watches tab updates and checks URLs against match rules synced from AliPrice. When a URL matches, it stores browsing-history entries locally and sends matched domains or recent matched URLs to AliPrice endpoints for statistics and recommendation decisions.

aliprice3v3.0.3Chrome Web Store
48Risk
Who publishes it

aliprice3 - 11 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aliprice3
Website
www.aiprice.com/information/index/page/contact

Same store account

11 other listings published from this account, 162k+ users between them. 3 of them carry a finding.

AliPrice100k+LowAiPrice(AliPrice) Search by image for AE20k+Low네이버 가격추적기 및 이미지 검색10k+MediumSeller Price & Coupon Monitor9k+CleanPinduoduo Search by Image8k+Low%EC%BF%A0%ED%8C%A1-%EC%87%BC%ED%95%91-%EB%8F%84%EC%9A%B0%EB%AF%B86k+Low5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Taobao tracking extension reports your AliExpress browsing to AliPrice

We observed the extension send the AliExpress page you were viewing to AliPrice's own server, requesting a recommendation, after that page matched a rule AliPrice pushes to the extension.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You visit AliExpress pages that match a rule AliPrice's server currently pushes to the extension.

The extension checks every open tab's URL against these rules about every 10 seconds.

The extension did this

The extension sends that page's URL to AliPrice's own server to fetch a shopping recommendation.

The request also carries your browser language and an internal ad-network ID.

Captured request
POSThttps://api.aliprice.com/index.php/chrome/extension/checkData

HTTP 200 with a JSON recommendation payload tied to the reported page.

Body
{  "url": "https://www.aliexpress.com/w/wholesale-laptop-bag.html",  "lang": "en",  "extension": "taobao_agent_tool",  "adids": [    "468"  ]}
What the recommendation request contains
  • Page URL
    https://www.aliexpress.com/w/wholesale-laptop-bag.html

    The exact AliExpress page you were viewing when the report fired.

  • Browser language
    en

    Your browser's language setting, used to localize the response.

  • Extension ID string
    taobao_agent_tool

    A fixed code that identifies this specific extension to AliPrice's backend.

  • Ad-network ID
    468

    An internal ID AliPrice uses to route the recommendation and any affiliate credit.

The code that does this

Reporting fires once a matched group passes five visits

Readable version

Readable threshold check

assets/js/background.js
matchedGroups.check = async () => {  const now = new Date();  const groups = await matchedGroups.get();  groups.forEach((group, i) => {    if (now.getTime() > group.expiredAt) return;    if (group.urls.length > 5 && !group.queriedOnce) {      groups[i].queriedOnce = true;      const lastUrl = group.urls[group.urls.length - 1];      if (lastUrl) sendRecommendationQuery(lastUrl);    }  });  await matchedGroups.set(groups);};

Readable report sender

assets/js/background.js
sendRecommendationQuery = async (pageUrl) => {  let lang = "en";  if (isHttpUrl(pageUrl) && pageUrl.trim() !== "") {    const settings = await store.get("settings");    if (settings.status === "success") lang = settings.data.platforms[settings.data.defaultPlatformName].language;    const body = {      url: pageUrl,      lang,      extension: "taobao_agent_tool",      adids: supportAdIds.length ? supportAdIds : Wext.config.supportAdIds || []    };    const { status, data } = await postJSON("/index.php/chrome/extension/checkData", body);    if (status === "success" && (!data || data.code === 200)) handleRecommendation(body, data);  }};
The code that does this

Default settings leave this on with no consent prompt

Readable version

Readable default settings

assets/js/background.js
getDefaultSettings = () => ({  privacyConsentRequired: false,  privacyStatus: true,  privacyItemCookiesStatus: true,  privacyItemFunctionalStatus: true,  hasPrivacyPromptShowedOnInstall: false});
When this fires

Every 32 minutes

Every 32 minutes, a separate alarm reports the domains of all currently matched page groups as usage statistics, apart from the per-page recommendation request above.

Where this data goes
    • api.aliprice.com

    Receives the browsed page URL, language, and ad-network ID for the recommendation query and the periodic domain rollup. Operated by AliPrice, this extension's developer.

What it can do

Permissions this extension asks for, as declared in version 2.3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.0.3, which we have not unpacked yet.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Schedule its own background tasks

    alarms

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Show you desktop notifications

    notifications

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Autofill Taobao Tracking No. & Shipping Info contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.aliprice.com

    Autofill Taobao Tracking No. & Shipping Info sends data to api.aliprice.com. 6 other extensions we have analysed send data here.

Updated 30 September 2026jdplopdpfhclmeobebhjcehomoofhfpg