Is Shein Image & ID Searcher safe?

Low risk

Shein Image & ID Searcher is low risk. Right-clicking an image and choosing "Search on Shein", or uploading a photo, sends it to a Cloudflare Worker, sis.aliexpressopiniones.workers.dev. The domain references AliExpress, not Shein, and isn't in the store listing.

AlixBlogv1.7.8Chrome Web Store
20Risk
Who publishes it

AlixBlog - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AlixBlog

Same store account

1 other listing published from this account, 100k+ users between them. 1 of them carries a finding.

Shein Coupon Finder100k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Image Search Sends Full Photos to an Undisclosed Third Party

Right-clicking an image and choosing "Search on Shein", or uploading a photo, sends it to a Cloudflare Worker, sis.aliexpressopiniones.workers.dev.

The domain references AliExpress, not Shein, and isn't in the store listing.

Severity
Low unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You right-click an image on any website (or upload a photo) and choose "Search on Shein."

The context menu entry is registered for http, https, and ftp pages, not just shein.com.

The extension did this

The extension fetches the full image and sends its raw bytes to a Cloudflare Worker at sis.aliexpressopiniones.workers.dev.

That domain has no visible connection to Shein and is not mentioned in the extension's Chrome Web Store listing.

Captured request
POSThttps://sis.aliexpressopiniones.workers.dev/?currency=USD

200 OK, JSON body, a list of product-style search results (id, image URL, price, product URL) that the extension renders as "Shein" matches.

Body
Raw binary image data (2,008 bytes in our test run) — byte-for-byte identical to the image just fetched from the source URL.
The code that does this

Image fetch-and-forward handler, background.bundle.js

Readable version

Beautified for readability

background.bundle.js
u = function() {  var t = n(e().mark((function t(r) {    var n, o;    return e().wrap((function(t) {      for (;;) switch (t.prev = t.next) {        case 0:          return t.next = 2, fetch(r);        case 2:          return t.next = 4, t.sent.blob();        case 4:          return n = t.sent, t.next = 7, c(n);        case 7:          return o = t.sent, t.abrupt("return", fetch("https://sis.aliexpressopiniones.workers.dev/?currency=USD", {            method: "POST",            headers: {},            body: o          }).then((function(t) {            return t.json()          })));        case 9:        case "end":          return t.stop()      }    }), t)  })));  return function(e) {    return t.apply(this, arguments)  }}()
Where the image goes
    • sis.aliexpressopiniones.workers.dev

    Receives every image searched via "Search on Shein" and returns the results. Hosted on Cloudflare Workers; the subdomain references AliExpress, not Shein, missing from the listing.

Reproduce it yourself

Fetches a public test image and POSTs it directly to the same endpoint the extension calls, showing the endpoint accepts an arbitrary image with no Shein-specific authentication and returns a JSON result set.

Requires
  • Node.js 18+
verify-image-forward.js · js
// verify-image-forward.js// Reproduces the request Shein Image & ID Searcher makes when a user// right-clicks any image and selects "Search on Shein."// Confirms the destination accepts an arbitrary image with no// Shein-specific credentials and returns a JSON result set.const IMAGE_URL = "https://upload.wikimedia.org/wikipedia/commons/4/47/PNG_transparency_demonstration_1.png";const ENDPOINT = "https://sis.aliexpressopiniones.workers.dev/?currency=USD";async function main() {  const imageResp = await fetch(IMAGE_URL);  const blob = await imageResp.blob();  console.log(`Fetched ${blob.size} bytes from ${IMAGE_URL}`);  const searchResp = await fetch(ENDPOINT, {    method: "POST",    headers: {},    body: blob,  });  console.log(`POST ${ENDPOINT} -> ${searchResp.status}`);  const json = await searchResp.json();  console.log("Response body:", JSON.stringify(json, null, 2));}main().catch((err) => {  console.error("Request failed:", err);  process.exit(1);});
How to run it
  1. 1Install Node.js 18+ (built-in fetch/Blob).
  2. 2Run `node verify-image-forward.js`.
  3. 3Compare the printed JSON to what the extension shows in its own search-results panel.

What it can do

Permissions this extension asks for, as declared in version 1.7.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Show you desktop notifications

    notifications

Updated 30 September 2026bfahigamndogcmlobbblmbkdhgnhdnmo