Is Помощник Яндекс Маркет safe?

Medium risk

Yandex Market Helper reports full URLs of visited pages matching a server-supplied list to api.aiprice.com.

The extension watches every tab that finishes loading and checks its URL against a list of patterns fetched from api.aiprice.com every 30 minutes. URLs that match are stored locally and uploaded roughly every 32 minutes, including the query string. Because the pattern list comes from the server, the set of reported sites can change without an extension update.

aliprice1v26.0.0Chrome Web Store
49Risk
Who publishes it

aliprice1 - 16 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aliprice1
Website
www.aliprice.com/information/index/page/contact

Same store account

16 other listings published from this account, 7k+ users between them, none of them carrying a finding.

Alibaba Image Downloader - Images & Videos3k+LowAmazon Image Downloader - Images & Videos934HighAmazon Image Search Tool922MediumAliexpress coupon&promo code finder676CleanAiPrice | 下载速卖通图片和视频527MediumAiPrice - 谷歌网页翻译499Low10 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension uploads full URLs of pages you visit to api.aiprice.com

Code analysis shows pages you load are matched against a regex list fetched from api.aiprice.com, and matching full URLs are sent back there in batches.

The server controls which sites match.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open web pages in any tab while the extension is installed with default settings.

The extension did this

The extension checks each URL against a server-supplied list and later uploads matching full URLs to api.aiprice.com.

Which sites match is decided by the list the server returns, so it can change without an update.

The code that does this

Upload routine for matched URLs

Readable version

l.report, formatted

assets/js/background.js
try {  const e = await l.get();  let t = [];  if (e.forEach((e => {      "group_statistics" === e.type && (t = t.concat(e.urls))    })), t = (0, i.jj)(t), t.length) {    const e = async () => {      let e = !1,        t = {};      return s && (e = (0, r.mf2)(u), e && (t = {        ...await u()      })), t    };    try {      (0, o.h)(null, {        subject: "group_statistics",        data: {          domain: t        },        headers: await e()      }, null)    } catch (e) {}    l.clear()  }} catch (e) {}        }, d.get = async () => {try {
The code that does this

Server-supplied match list is synced into local storage

Readable version

d.sync, formatted

assets/js/background.js
        }, d.sync = async () => {try {  const {    status: e,    data: t  } = await (0, n.a1)();  return !("success" !== e || !t || 200 !== t.code) && (await r.Ruf.set(d.storeName, t.data, !0), !0)} catch (e) {  return !1
What the upload carries
  • Visited page URLs
    https://www.example-shop.com/item/12345?ref=search&q=headphones

    The full address of each matching page you visited, including any query string.

  • Request subject
    group_statistics

    Labels the batch so the server files it as visit statistics.

  • Grouping key
    {"domain":["https://www.example-shop.com/item/12345?ref=search&q=headphones"]}

    URLs are grouped under a domain key in the request body.

Where the data goes
    • api.aiprice.com

    Serves the match list and receives the uploaded URL batches (index.php/chrome/statistics/Index).

Check if you're affected

Fetches the live match list the extension syncs and reports which of your URLs would be queued for upload.

Requires
  • Node.js 18+
check_aiprice_match.js · js
// Reproducer: lists which tab URLs the extension would queue for upload.// Fetch the server regex list the extension syncs, then test your URLs against it.const https = require("https");const urls = process.argv.slice(2);https.get("https://api.aiprice.com/index.php/chrome/extension/checkLink?nocookie=1", r => {  let b = ""; r.on("data", c => b += c); r.on("end", () => {    const cfg = JSON.parse(b).data || {};    const groups = cfg.group_statistics || {};    for (const u of urls) {      const clean = u.replace(/(#).*/gi, "");      for (const [domain, list] of Object.entries(groups)) {        if (Array.isArray(list) && list.some(p => new RegExp(p).test(u))) {          console.log("WOULD REPORT", domain, clean);        }      }    }  });});
How to run it
  1. 1Install Node.js 18 or later.
  2. 2Save the file.
  3. 3Run: node check_aiprice_match.js https://example.com/page.
  4. 4Any WOULD REPORT line means the URL matches the server list.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Помощник Яндекс Маркет contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.aiprice.com

    Помощник Яндекс Маркет sends data to api.aiprice.com. 24 other extensions we have analysed send data here.

Updated 15 October 2026beojnkokffefhfbjbeccnpmldkjbjjno