Is Download Aliexpress Product Images & Videos safe?
Download Aliexpress Product Images & Videos rewrites AliExpress shopping pages through an affiliate deep-link endpoint.
When an active AliExpress tab loads a cart, shop, category, or item page, the background service worker strips query parameters and redirects the tab to s.click.aliexpress.com/deep_link.htm with the page URL as dl_target_url. This sends the visited AliExpress page URL to AliExpress's click-tracking endpoint before the user continues shopping.
Who publishes itSaxsos Inc - 11 other listings from the same operator, 2 of them carrying a finding
Saxsos Inc - 11 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 8k+ users between them. 1 of them carries a finding.
Same operator - 10 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Automatic Affiliate Redirect on AliExpress Pages
Opening an AliExpress product, cart, shop, or category page redirects that tab through the extension's affiliate link at s.click.aliexpress.com, then back automatically.
It discards any existing affiliate tag, replacing it with its own.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open an AliExpress item, cart, shop, or category page in your active browser tab.
The extension's background script strips the page URL's query string and sends the tab through its own affiliate link before returning you to the same page.
The redirect fires on page load, before you interact with anything, and only skips pages that already carry the string 'trendpiper'.
HTTP 302. The tab lands back on the same item URL with aff_fsk=55XgYCV2, sk=55XgYCV2, and connected_by=trendpiper appended.
The redirect logic, from the extension's shipping background script.
The navigation listener and redirect
// Fires on every tab navigation that starts loading.chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) { if (changeInfo.status === "loading") { chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) { const activeTab = tabs[0]; if (!activeTab || !activeTab.url) return; // Drop the existing query string entirely (any incoming affiliate // tag goes with it) and rebuild the URL as the extension's own // affiliate deep link. const strippedUrl = activeTab.url.split("?")[0]; const redirectURL = `https://s.click.aliexpress.com/deep_link.htm?aff_short_key=55XgYCV2` + `&dl_target_url=${strippedUrl}&connected_by=trendpiper`; const isMatchingPage = (activeTab.url.includes("aliexpress.") && (activeTab.url.includes("shoppingcart") || activeTab.url.includes("/shop") || activeTab.url.includes("cart") || activeTab.url.includes("category") || activeTab.url.includes("item"))); const alreadyTagged = activeTab.url.indexOf("trendpiper") !== -1; if (isMatchingPage && !alreadyTagged) { chrome.tabs.update(activeTab.id, { url: redirectURL }); } }); }});- The AliExpress page you were viewinghttps://www.aliexpress.com/item/1005006109758945.html
The page URL with its query string removed, passed through as the affiliate link's destination.
- Affiliate identifieraff_short_key=55XgYCV2
A fixed code identifying this extension's affiliate account. The same value is used for every user and every redirect.
- Loop-guard markerconnected_by=trendpiper
Appended so the extension can tell it already redirected this URL once, so it does not redirect a second time.
- s.click.aliexpress.com
AliExpress's own affiliate link-tracking domain. Attributes the visit and any purchase to the extension's affiliate account before forwarding back to the original page.
What it can do
Permissions this extension asks for, as declared in version 3.8.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on aliexpress.com
*://*.aliexpress.com/
Read and change your data on aliexpress.ru
*://*.aliexpress.ru/
Read and change your data on aliexpress.us
*://*.aliexpress.us/
Read and change your data on alicdn.com
*://*.alicdn.com/
Read and change your data on cloud.video.taobao.com
*://cloud.video.taobao.com/
Start, monitor and manage your downloads
downloads
Where it sends data
Destinations our analysis observed Download Aliexpress Product Images & Videos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- s.click.aliexpress.com
Download Aliexpress Product Images & Videos sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.