Is Baba Image Downloader safe?

Medium risk

Baba Image Downloader redirects AliExpress and Alibaba product pages through rzekl.com affiliate links.

When a tab loads an AliExpress item page or Alibaba product page, the extension can rewrite the navigation through a rzekl.com affiliate redirect if its cooldown has expired. The redirect includes the original product page origin and path, so rzekl.com receives the shopping page destination.

45Risk
Who publishes it

todd - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
todd

Same store account

1 other listing published from this account, 2k+ users between them. 1 of them carries a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Automatic Affiliate Redirect on AliExpress and Alibaba Pages

Opening an AliExpress/Alibaba listing triggers an automatic admitad redirect via rzekl.com, then returns you.

Only origin/path forward; other params, e.g. a rival tag, drop.

Capped at 1/site/12h, backdated at install so page 1 qualifies.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a product listing on AliExpress or Alibaba, for example by clicking a search result or a link from another site.

The extension did this

The background service worker sends your tab through an admitad affiliate redirect at rzekl.com, then returns you to the same product page.

The redirect is triggered by a background tab-update listener, not by clicking the extension's own download button.

When this fires

Every 12 hours

Each site is redirected through the affiliate link at most once every 12 hours. A stored timestamp is set 23 hours in the past when the extension is installed, so the first matching product page opened after install already qualifies for a redirect.

The code that does this

The redirect listeners and the URL builder, from the extension's shipping service worker.

Readable version

Per-merchant config and URL builder

const ALIEXPRESS = {  loopMarker: "aff_fcid",  source: "https://www.aliexpress.com/item/",  affiliateBase: "https://rzekl.com/g/1e8d11449474d91068ed16525dc3e8/"};const ALIBABA = {  loopMarker: "cps_sk",  source: "https://www.alibaba.com/product-detail/",  affiliateBase: "https://rzekl.com/g/pm1aev55cl74d91068ed219aa26f6f/"};// Only the origin + pathname of the product page survive here — the rest// of the query string, including any affiliate tag already on the URL,// is dropped before the redirect URL is built.function buildRedirect(site, productUrl) {  const u = new URL(productUrl);  const strippedUrl = `${u.origin}${u.pathname}`;  const base = site === "aliexpress" ? ALIEXPRESS.affiliateBase : ALIBABA.affiliateBase;  const redirect = new URL(base);  redirect.searchParams.set("subid", "aid");  redirect.searchParams.set("ulp", strippedUrl);  return redirect.href;}

The navigation listeners and install-time backdate

// Fires on every tab navigation; redirects at most once every 12 hours per site.chrome.tabs.onUpdated.addListener(async (tabId, changeInfo) => {  if (changeInfo.url && changeInfo.url.includes(ALIEXPRESS.source)) {    if (changeInfo.url.includes(ALIEXPRESS.loopMarker)) return; // already redirected once    const lastRedirect = await getStored("ali") || 0;    if (lastRedirect < Date.now() - 12 * 60 * 60 * 1000) {      const redirectUrl = buildRedirect("aliexpress", changeInfo.url);      await setStored("ali", Date.now());      chrome.tabs.update(tabId, { url: redirectUrl });    }  }});// A second, identical listener covers alibaba.com/product-detail/ pages.// On install, both throttle timestamps are backdated 23 hours so the// first matching page load already qualifies for a redirect.chrome.runtime.onInstalled.addListener(() => {  setStored("ali", Date.now() - 23 * 60 * 60 * 1000);  setStored("baba", Date.now() - 23 * 60 * 60 * 1000);});
What happens when the product URL already carries another affiliate program's tag
  1. same navigation

    You did

    You open a product link that already carries another affiliate program's tracking parameter in its query string.

    The extension did

    The redirect keeps only the origin and path of the page and forwards that to admitad; the existing tag never reaches the ulp parameter, and admitad applies its own affiliate parameters on the return trip.

    A test navigation with a competing affiliate parameter already on the URL confirmed the code checks for exactly two strings before redirecting, aff_fcid and cps_sk, its own loop markers, and drops every other query parameter regardless of what it is.

Where the redirect sends the tab
    • rzekl.com

    Admitad-branded affiliate redirect domain the tab is sent through before reaching the product page; receives the page's origin + path in the ulp query parameter.

    • s.click.aliexpress.com

    Admitad's own deep-link redirector, reached from rzekl.com on the AliExpress path; applies the final affiliate parameters before the tab lands back on aliexpress.com.

What it can do

Permissions this extension asks for, as declared in version 1.3.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on alibaba.com

    *://*.alibaba.com/

  • Read and change your data on alicdn.com

    *://*.alicdn.com/

  • Read and change your data on aliexpress-media.com

    *://*.aliexpress-media.com/

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/

  • Read and change your data on aliexpress.ru

    *://*.aliexpress.ru/

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Baba Image Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • rzekl.com

    Baba Image Downloader sends data to rzekl.com. One other extension we have analysed sends data here.

Updated 30 September 2026ignkhlhlaoifkkgfojaefffeomlhamha