Is Download Aliexpress Product Images & Videos safe?

Medium risk

Download Aliexpress Product Images & Videos rewrites AliExpress shopping pages through an affiliate deep-link endpoint.

When an active AliExpress tab loads a cart, shop, category, or item page, the background service worker strips query parameters and redirects the tab to s.click.aliexpress.com/deep_link.htm with the page URL as dl_target_url. This sends the visited AliExpress page URL to AliExpress's click-tracking endpoint before the user continues shopping.

Saxsos Incv3.8.5Chrome Web Store
45Risk
Who publishes it

Saxsos Inc - 11 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Saxsos Inc
Declared legal entity
Saxsos Inc
Registered address
BH Builders Building, Balughat, Manikdi, Dhaka Cantonment, Dhaka 1206, BD
Registered contact
Sagor Al Mamun

Same store account

1 other listing published from this account, 8k+ users between them. 1 of them carries a finding.

Same operator - 10 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Automatic Affiliate Redirect on AliExpress Pages

Opening an AliExpress product, cart, shop, or category page redirects that tab through the extension's affiliate link at s.click.aliexpress.com, then back automatically.

It discards any existing affiliate tag, replacing it with its own.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress item, cart, shop, or category page in your active browser tab.

The extension did this

The extension's background script strips the page URL's query string and sends the tab through its own affiliate link before returning you to the same page.

The redirect fires on page load, before you interact with anything, and only skips pages that already carry the string 'trendpiper'.

Captured request
GEThttps://s.click.aliexpress.com/deep_link.htm?aff_short_key=55XgYCV2&dl_target_url=https://www.aliexpress.com/item/1005006109758945.html&connected_by=trendpiper

HTTP 302. The tab lands back on the same item URL with aff_fsk=55XgYCV2, sk=55XgYCV2, and connected_by=trendpiper appended.

The code that does this

The redirect logic, from the extension's shipping background script.

Readable version

The navigation listener and redirect

// Fires on every tab navigation that starts loading.chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) {  if (changeInfo.status === "loading") {    chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {      const activeTab = tabs[0];      if (!activeTab || !activeTab.url) return;      // Drop the existing query string entirely (any incoming affiliate      // tag goes with it) and rebuild the URL as the extension's own      // affiliate deep link.      const strippedUrl = activeTab.url.split("?")[0];      const redirectURL =        `https://s.click.aliexpress.com/deep_link.htm?aff_short_key=55XgYCV2` +        `&dl_target_url=${strippedUrl}&connected_by=trendpiper`;      const isMatchingPage =        (activeTab.url.includes("aliexpress.") &&          (activeTab.url.includes("shoppingcart") ||            activeTab.url.includes("/shop") ||            activeTab.url.includes("cart") ||            activeTab.url.includes("category") ||            activeTab.url.includes("item")));      const alreadyTagged = activeTab.url.indexOf("trendpiper") !== -1;      if (isMatchingPage && !alreadyTagged) {        chrome.tabs.update(activeTab.id, { url: redirectURL });      }    });  }});
What the redirect URL carries, and what comes back
  • The AliExpress page you were viewing
    https://www.aliexpress.com/item/1005006109758945.html

    The page URL with its query string removed, passed through as the affiliate link's destination.

  • Affiliate identifier
    aff_short_key=55XgYCV2

    A fixed code identifying this extension's affiliate account. The same value is used for every user and every redirect.

  • Loop-guard marker
    connected_by=trendpiper

    Appended so the extension can tell it already redirected this URL once, so it does not redirect a second time.

Where the redirect lands
    • s.click.aliexpress.com

    AliExpress's own affiliate link-tracking domain. Attributes the visit and any purchase to the extension's affiliate account before forwarding back to the original page.

What it can do

Permissions this extension asks for, as declared in version 3.8.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on aliexpress.com

    *://*.aliexpress.com/

  • Read and change your data on aliexpress.ru

    *://*.aliexpress.ru/

  • Read and change your data on aliexpress.us

    *://*.aliexpress.us/

  • Read and change your data on alicdn.com

    *://*.alicdn.com/

  • Read and change your data on cloud.video.taobao.com

    *://cloud.video.taobao.com/

  • Start, monitor and manage your downloads

    downloads

Where it sends data

Destinations our analysis observed Download Aliexpress Product Images & Videos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Download Aliexpress Product Images & Videos sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

Updated 30 September 2026oapbenmnggmfppgcipceajnpimebigfe