Is Baba Image Downloader safe?
Baba Image Downloader redirects AliExpress and Alibaba product pages through rzekl.com affiliate links.
When a tab loads an AliExpress item page or Alibaba product page, the extension can rewrite the navigation through a rzekl.com affiliate redirect if its cooldown has expired. The redirect includes the original product page origin and path, so rzekl.com receives the shopping page destination.
Who publishes ittodd - 1 other listing from the same operator, 1 of them carrying a finding
todd - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 2k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Automatic Affiliate Redirect on AliExpress and Alibaba Pages
Opening an AliExpress/Alibaba listing triggers an automatic admitad redirect via rzekl.com, then returns you.
Only origin/path forward; other params, e.g. a rival tag, drop.
Capped at 1/site/12h, backdated at install so page 1 qualifies.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a product listing on AliExpress or Alibaba, for example by clicking a search result or a link from another site.
The background service worker sends your tab through an admitad affiliate redirect at rzekl.com, then returns you to the same product page.
The redirect is triggered by a background tab-update listener, not by clicking the extension's own download button.
Every 12 hours
Each site is redirected through the affiliate link at most once every 12 hours. A stored timestamp is set 23 hours in the past when the extension is installed, so the first matching product page opened after install already qualifies for a redirect.
The redirect listeners and the URL builder, from the extension's shipping service worker.
Per-merchant config and URL builder
const ALIEXPRESS = { loopMarker: "aff_fcid", source: "https://www.aliexpress.com/item/", affiliateBase: "https://rzekl.com/g/1e8d11449474d91068ed16525dc3e8/"};const ALIBABA = { loopMarker: "cps_sk", source: "https://www.alibaba.com/product-detail/", affiliateBase: "https://rzekl.com/g/pm1aev55cl74d91068ed219aa26f6f/"};// Only the origin + pathname of the product page survive here — the rest// of the query string, including any affiliate tag already on the URL,// is dropped before the redirect URL is built.function buildRedirect(site, productUrl) { const u = new URL(productUrl); const strippedUrl = `${u.origin}${u.pathname}`; const base = site === "aliexpress" ? ALIEXPRESS.affiliateBase : ALIBABA.affiliateBase; const redirect = new URL(base); redirect.searchParams.set("subid", "aid"); redirect.searchParams.set("ulp", strippedUrl); return redirect.href;}The navigation listeners and install-time backdate
// Fires on every tab navigation; redirects at most once every 12 hours per site.chrome.tabs.onUpdated.addListener(async (tabId, changeInfo) => { if (changeInfo.url && changeInfo.url.includes(ALIEXPRESS.source)) { if (changeInfo.url.includes(ALIEXPRESS.loopMarker)) return; // already redirected once const lastRedirect = await getStored("ali") || 0; if (lastRedirect < Date.now() - 12 * 60 * 60 * 1000) { const redirectUrl = buildRedirect("aliexpress", changeInfo.url); await setStored("ali", Date.now()); chrome.tabs.update(tabId, { url: redirectUrl }); } }});// A second, identical listener covers alibaba.com/product-detail/ pages.// On install, both throttle timestamps are backdated 23 hours so the// first matching page load already qualifies for a redirect.chrome.runtime.onInstalled.addListener(() => { setStored("ali", Date.now() - 23 * 60 * 60 * 1000); setStored("baba", Date.now() - 23 * 60 * 60 * 1000);});same navigation
You didYou open a product link that already carries another affiliate program's tracking parameter in its query string.
The extension didThe redirect keeps only the origin and path of the page and forwards that to admitad; the existing tag never reaches the ulp parameter, and admitad applies its own affiliate parameters on the return trip.
A test navigation with a competing affiliate parameter already on the URL confirmed the code checks for exactly two strings before redirecting, aff_fcid and cps_sk, its own loop markers, and drops every other query parameter regardless of what it is.
- rzekl.com
Admitad-branded affiliate redirect domain the tab is sent through before reaching the product page; receives the page's origin + path in the ulp query parameter.
- s.click.aliexpress.com
Admitad's own deep-link redirector, reached from rzekl.com on the AliExpress path; applies the final affiliate parameters before the tab lands back on aliexpress.com.
What it can do
Permissions this extension asks for, as declared in version 1.3.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on alibaba.com
*://*.alibaba.com/
Read and change your data on alicdn.com
*://*.alicdn.com/
Read and change your data on aliexpress-media.com
*://*.aliexpress-media.com/
Read and change your data on aliexpress.com
*://*.aliexpress.com/
Read and change your data on aliexpress.ru
*://*.aliexpress.ru/
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Where it sends data
Destinations our analysis observed Baba Image Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- rzekl.com
Baba Image Downloader sends data to rzekl.com. One other extension we have analysed sends data here.