Is Shein Image & ID Searcher safe?
Shein Image & ID Searcher is low risk. Right-clicking an image and choosing "Search on Shein", or uploading a photo, sends it to a Cloudflare Worker, sis.aliexpressopiniones.workers.dev. The domain references AliExpress, not Shein, and isn't in the store listing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Image Search Sends Full Photos to an Undisclosed Third Party
Right-clicking an image and choosing "Search on Shein", or uploading a photo, sends it to a Cloudflare Worker, sis.aliexpressopiniones.workers.dev.
The domain references AliExpress, not Shein, and isn't in the store listing.
You right-click an image on any website (or upload a photo) and choose "Search on Shein."
The context menu entry is registered for http, https, and ftp pages, not just shein.com.
The extension fetches the full image and sends its raw bytes to a Cloudflare Worker at sis.aliexpressopiniones.workers.dev.
That domain has no visible connection to Shein and is not mentioned in the extension's Chrome Web Store listing.
Raw binary image data (2,008 bytes in our test run) — byte-for-byte identical to the image just fetched from the source URL.
Image fetch-and-forward handler, background.bundle.js
u = function() {
var t = n(e().mark((function t(r) {
var n, o;
return e().wrap((function(t) {
for (;;) switch (t.prev = t.next) {
case 0:
return t.next = 2, fetch(r);
case 2:
return t.next = 4, t.sent.blob();
case 4:
return n = t.sent, t.next = 7, c(n);
case 7:
return o = t.sent, t.abrupt("return", fetch("https://sis.aliexpressopiniones.workers.dev/?currency=USD", {
method: "POST",
headers: {},
body: o
}).then((function(t) {
return t.json()
})));
case 9:
case "end":
return t.stop()
}
}), t)
})));
return function(e) {
return t.apply(this, arguments)
}
}()- sis.aliexpressopiniones.workers.dev
Receives every image searched via "Search on Shein" and returns the results. Hosted on Cloudflare Workers; the subdomain references AliExpress, not Shein, missing from the listing.
Fetches a public test image and POSTs it directly to the same endpoint the extension calls, showing the endpoint accepts an arbitrary image with no Shein-specific authentication and returns a JSON result set.
// verify-image-forward.js
// Reproduces the request Shein Image & ID Searcher makes when a user
// right-clicks any image and selects "Search on Shein."
// Confirms the destination accepts an arbitrary image with no
// Shein-specific credentials and returns a JSON result set.
const IMAGE_URL = "https://upload.wikimedia.org/wikipedia/commons/4/47/PNG_transparency_demonstration_1.png";
const ENDPOINT = "https://sis.aliexpressopiniones.workers.dev/?currency=USD";
async function main() {
const imageResp = await fetch(IMAGE_URL);
const blob = await imageResp.blob();
console.log(`Fetched ${blob.size} bytes from ${IMAGE_URL}`);
const searchResp = await fetch(ENDPOINT, {
method: "POST",
headers: {},
body: blob,
});
console.log(`POST ${ENDPOINT} -> ${searchResp.status}`);
const json = await searchResp.json();
console.log("Response body:", JSON.stringify(json, null, 2));
}
main().catch((err) => {
console.error("Request failed:", err);
process.exit(1);
});
- 1Install Node.js 18+ (built-in fetch/Blob).
- 2Run `node verify-image-forward.js`.
- 3Compare the printed JSON to what the extension shows in its own search-results panel.