Is BuscaAli safe?

Medium risk

BuscaAli is medium risk. BuscaAli sends the AliExpress URL you're viewing to AliExpress's affiliate API, signed with a hardcoded key, to mint a tracking link, then redirects your browser through it before the page loads, on every matching page, unprompted.

v1.0.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Item Pages Rewritten Into Affiliate Redirects Automatically

BuscaAli sends the AliExpress URL you're viewing to AliExpress's affiliate API, signed with a hardcoded key, to mint a tracking link, then redirects your browser through it before the page loads, on every matching page, unprompted.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress product page whose URL doesn't already carry an affiliate tag.

The extension did this

BuscaAli asks AliExpress's own affiliate API to mint a new tracking link for that exact page, then redirects your browser to it.

No click, button, or extension setting is involved; the check and redirect run automatically as soon as the page loads.

What gets sent to AliExpress's affiliate API on every item page you open
  • The product page you're viewing
    https://www.aliexpress.com/item/1005011939854000.html

    The exact URL of the item page, sent as the page AliExpress should generate a tracking link for.

  • Developer app key
    504672

    A fixed ID that tells AliExpress which developer account should be credited for any purchase made through the generated link.

  • Request signature
    bxFTCNLrpISDMEhEvswCHJKHM9lsSX3C

    A hardcoded signing key baked into the extension, used to authenticate the request as coming from this developer's app.

  • Tracking ID
    default

    A fixed label AliExpress uses to bucket clicks generated by this extension.

Captured request
POSThttps://api-sg.aliexpress.com/sync?app_signature=bxFTCNLrpISDMEhEvswCHJKHM9lsSX3C&promotion_link_type=0&source_values=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005011939854000.html&tracking_id=default&app_key=504672&sign_method=sha256&method=aliexpress.affiliate.link.generate&sign=<hmac_sha256_hex_uppercased>

200 OK; JSON body's aliexpress_affiliate_link_generate_response.resp_result.result.promotion_links.promotion_link[0].promotion_link contained https://s.click.aliexpress.com/e/_c3se5mYJ, which the extension then assigned to window.location.href.

The code that does this

The navigation gate and payload assembly, from the extension's shipped content script.

Readable version

Gate + payload assembly + redirect, in start()

if (  window.location.href.includes(".html") &&  !window.location.href.includes("aff_fcid")) {  const baseHref = window.location.href;  const dataToSend = {    app_signature: "bxFTCNLrpISDMEhEvswCHJKHM9lsSX3C",    promotion_link_type: 0,    source_values: baseHref,    tracking_id: "default",    app_key: "504672",    sign_method: "sha256",    timestamp: new Date().getTime(),    method: "aliexpress.affiliate.link.generate",  };  const sign = await getSignatureByParams(    "bxFTCNLrpISDMEhEvswCHJKHM9lsSX3C",    dataToSend  );  const url =    "https://api-sg.aliexpress.com/sync?" +    new URLSearchParams({      ...dataToSend,      sign: sign.toUpperCase(),    });  const response = await fetch(url, { method: "POST" });  const json = await response.json();  const newHref =    json["aliexpress_affiliate_link_generate_response"]["resp_result"][      "result"    ]["promotion_links"]["promotion_link"][0]["promotion_link"];  if (newHref) {    window.location.href = newHref;  }}
Where the request and redirect go
    • api-sg.aliexpress.com

    AliExpress's own affiliate-link-generation API. Receives the page URL you're viewing plus the extension developer's hardcoded app key on every matching item page.

    • s.click.aliexpress.com

    AliExpress's affiliate short-link redirector. The browser is sent here automatically; it forwards to the final tagged page.

What it can do

Permissions this extension asks for, as declared in version 1.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on localhost:3000

    http://localhost:3000/*

  • Read and change your data on www.sandrovilasboas.vps-kinghost.net:3000

    http://www.sandrovilasboas.vps-kinghost.net:3000/*

  • Add items to the right-click menu

    contextMenus

Updated 30 September 2026fjoaobnnececkgfeopklnicdaifogohn