Is 티몬 가격 추적기 safe?

Low risk

Tmon Price Tracker sends tab URLs matching server-supplied patterns to api.aliprice.com every 32 minutes.

The extension watches every http(s) page you load and checks the URL against a list of patterns it downloads from api.aliprice.com. Matching URLs, including their paths and query strings, are stored and then posted in bulk to the same service about every 32 minutes. Because the pattern list is controlled by the server, the vendor decides which browsing is reported.

aliprice4v4.0.0Chrome Web Store
20Risk
Who publishes it

aliprice4 - 19 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aliprice4
Website
www.aliprice.com/information/index?page=contact

Same store account

19 other listings published from this account, 119k+ users between them. 2 of them carry a finding.

AiPrice50k+MediumAiPrice(AliPrice) Search by Image for TB Beta20k+MediumAiPrice(AliPrice) Search by Image for China Import Beta10k+MediumПомощник OZON10k+High1688 Price Tracker8k+MediumAiPrice(AliPrice) Price Tracker Beta7k+Medium13 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliPrice batches matching page URLs from your tabs to api.aliprice.com

Code analysis shows the extension saves the full URL of pages you load when they match patterns fetched from api.aliprice.com, then posts the saved list to api.aliprice.com about every 32 minutes.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You finish loading an http or https page.

Applies to all sites; the extension holds the all-sites host permission.

The extension did this

If the URL matches a server-supplied pattern, it is stored and later posted to api.aliprice.com.

Stored URLs are sent in batches and then cleared.

The code that does this

Report routine sends stored group_statistics URLs

Readable version

Alarm that triggers the report

assets/js/background.js
const alarm = { name: "REPORT_BROWSERING_HISTORY", options: { periodInMinutes: l.reportInterVal } };browser.alarms.ensure(alarm, () => { l.report() });
Fields in the statistics/Index POST
  • data.domain
    https://www.example-shop.com/item/12345?ref=search (illustrative)

    List of full page URLs (path and query kept, #fragment removed) that matched.

  • subject
    group_statistics

    Fixed report type label.

  • headers
    Extension version and app identifiers (illustrative)

    App-info headers added to the request when available.

Host involved in both directions
    • api.aliprice.com

    Supplies URL regexes via checkLink and receives matched URLs at statistics/Index.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed 티몬 가격 추적기 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.aliprice.com

    티몬 가격 추적기 sends data to api.aliprice.com. 8 other extensions we have analysed send data here.

Updated 15 October 2026ijhhofehfpncoelnemcdhhlfbbfbgkmn