Is Shein Image & ID Searcher safe?

Low risk

Shein Image & ID Searcher is low risk. Right-clicking an image and choosing "Search on Shein", or uploading a photo, sends it to a Cloudflare Worker, sis.aliexpressopiniones.workers.dev. The domain references AliExpress, not Shein, and isn't in the store listing.

AlixBlogv1.7.8Chrome Web Store
20Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityLOW
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Image Search Sends Full Photos to an Undisclosed Third Party

Right-clicking an image and choosing "Search on Shein", or uploading a photo, sends it to a Cloudflare Worker, sis.aliexpressopiniones.workers.dev.

The domain references AliExpress, not Shein, and isn't in the store listing.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You right-click an image on any website (or upload a photo) and choose "Search on Shein."

The context menu entry is registered for http, https, and ftp pages, not just shein.com.

The extension did this

The extension fetches the full image and sends its raw bytes to a Cloudflare Worker at sis.aliexpressopiniones.workers.dev.

That domain has no visible connection to Shein and is not mentioned in the extension's Chrome Web Store listing.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://sis.aliexpressopiniones.workers.dev/?currency=USD
200 OK, JSON body, a list of product-style search results (id, image URL, price, product URL) that the extension renders as "Shein" matches.
Body
Raw binary image data (2,008 bytes in our test run) — byte-for-byte identical to the image just fetched from the source URL.
03EvidenceCODE COMPARE
The code that does this

Image fetch-and-forward handler, background.bundle.js

What it actually does
Beautified for readabilitybackground.bundle.js
u = function() {
  var t = n(e().mark((function t(r) {
    var n, o;
    return e().wrap((function(t) {
      for (;;) switch (t.prev = t.next) {
        case 0:
          return t.next = 2, fetch(r);
        case 2:
          return t.next = 4, t.sent.blob();
        case 4:
          return n = t.sent, t.next = 7, c(n);
        case 7:
          return o = t.sent, t.abrupt("return", fetch("https://sis.aliexpressopiniones.workers.dev/?currency=USD", {
            method: "POST",
            headers: {},
            body: o
          }).then((function(t) {
            return t.json()
          })));
        case 9:
        case "end":
          return t.stop()
      }
    }), t)
  })));
  return function(e) {
    return t.apply(this, arguments)
  }
}()
04EvidenceTHIRD PARTY LIST
Where the image goes
  • sis.aliexpressopiniones.workers.dev

    Receives every image searched via "Search on Shein" and returns the results. Hosted on Cloudflare Workers; the subdomain references AliExpress, not Shein, missing from the listing.

05EvidenceARTIFACT
Reproduce it yourself

Fetches a public test image and POSTs it directly to the same endpoint the extension calls, showing the endpoint accepts an arbitrary image with no Shein-specific authentication and returns a JSON result set.

RequiresNode.js 18+
verify-image-forward.js · js
// verify-image-forward.js
// Reproduces the request Shein Image & ID Searcher makes when a user
// right-clicks any image and selects "Search on Shein."
// Confirms the destination accepts an arbitrary image with no
// Shein-specific credentials and returns a JSON result set.

const IMAGE_URL = "https://upload.wikimedia.org/wikipedia/commons/4/47/PNG_transparency_demonstration_1.png";
const ENDPOINT = "https://sis.aliexpressopiniones.workers.dev/?currency=USD";

async function main() {
  const imageResp = await fetch(IMAGE_URL);
  const blob = await imageResp.blob();
  console.log(`Fetched ${blob.size} bytes from ${IMAGE_URL}`);

  const searchResp = await fetch(ENDPOINT, {
    method: "POST",
    headers: {},
    body: blob,
  });

  console.log(`POST ${ENDPOINT} -> ${searchResp.status}`);
  const json = await searchResp.json();
  console.log("Response body:", JSON.stringify(json, null, 2));
}

main().catch((err) => {
  console.error("Request failed:", err);
  process.exit(1);
});
How to run it
  1. 1
    Install Node.js 18+ (built-in fetch/Blob).
  2. 2
    Run `node verify-image-forward.js`.
  3. 3
    Compare the printed JSON to what the extension shows in its own search-results panel.
Updated 17 September 2026bfahigamndogcmlobbblmbkdhgnhdnmo