Is Skip AliExpress Bundle Deals: Just This One! safe?

Medium risk

Skip AliExpress Bundle Deals: Just This One! sends AliExpress product URLs and shipping country to a developer Worker.

On AliExpress pages, the extension collects product URLs from BundleDeals and wishlist links and reads the shipping country from the aep_usuc_f cookie. It sends those URLs and the country code to a developer Cloudflare Worker to receive rewritten product links.

johnnyaugv2.2.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AliExpress deal-finder sends product links and shipping country to developer

On AliExpress pages with deal links, the extension sends the product URLs you're viewing and your two-letter shipping country to a Cloudflare Worker the developer runs, which returns rewritten links.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open an AliExpress page that has BundleDeals or wishlist product links on it.

The content script rescans the page for these links roughly once a second.

The extension did this

The extension sends those product URLs and your shipping country to a Cloudflare Worker the developer controls.

The Worker replies with rewritten versions of the links, which the extension caches and swaps in.

Captured request
GEThttps://link-improver.johnnyaug.workers.dev/?product_urls=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109951192.html%2Chttps%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005005432112233.html&ship_to_country=UK

200 OK, returning a JSON map of each URL to a rewritten link, which the extension caches. Product URLs here are illustrative; ship_to_country=UK is the exact captured value.

Data sent to the developer's Worker
  • Product page links
    https://www.aliexpress.com/item/1005006109951192.html, https://www.aliexpress.com/item/1005005432112233.html

    The AliExpress product pages currently shown to you in a BundleDeals or wishlist list.

  • Shipping country code
    UK

    The two-letter country your AliExpress account ships to, read from a site cookie.

The code that does this

Collecting links and country, then requesting the Worker

Readable version

Queueing links and sending them to the background (content-0.js)

content_scripts/content-0.js
function queueLinkForClickTracking(anchorEl, productUrl, clickSource) {  pendingProductUrls.push(productUrl);  anchorEl.addEventListener("click", async () => {    browser.runtime.sendMessage({      type: "ELEMENT_LINK_CLICKED",      new_url: improvedLinkCache[productUrl] || productUrl,      is_improved: productUrl in improvedLinkCache,      click_source: clickSource    });  });}async function flushQueuedLinksToBackground() {  if (pendingProductUrls.length === 0) return;  const urlsToImprove = [...pendingProductUrls];  pendingProductUrls.length = 0;  const response = await browser.runtime.sendMessage({    type: "IMPROVE_LINK",    productUrls: urlsToImprove,    shippingCountry: readShippingCountryFromCookie()  });  if (response && response.improvedUrls) {    Object.assign(improvedLinkCache, response.improvedUrls);  }}function readShippingCountryFromCookie() {  // aep_usuc_f is AliExpress's own site cookie for locale/shipping settings.  const cookie = document.cookie.split("; ").find(c => c.startsWith("aep_usuc_f="));  if (cookie) {    const match = cookie.match(/region=([A-Z]{2})/);    if (match) return match[1]; // e.g. "UK", "US"  }  return null;}// Re-scan the page for BundleDeals/wishlist product links every second,// then flush anything newly found to the background service worker.scanPageForDealLinks();setInterval(scanPageForDealLinks, 1000);

Building the request to the Worker (service_worker.js)

background/service_worker.js
case "IMPROVE_LINK":  try {    await refreshAffiliateProbeStatus();    const mode = await getAffiliateLinkMode(); // ALLOWED | BLOCKED | ONLY_LOCAL    if (mode === LinkMode.BLOCKED) {      sendResponse({ improvedUrls: {} });      break;    }    // Check the local cache first so repeat views of the same product    // don't trigger a new network request.    const { results: cachedUrls, missing: uncachedUrls } =      await readCachedImprovedUrls(message.productUrls);    let improvedUrls = { ...cachedUrls };    if (mode === LinkMode.ONLY_LOCAL) {      sendResponse({ improvedUrls });      break;    }    if (uncachedUrls.length > 0) {      const params = new URLSearchParams({ product_urls: uncachedUrls.join(",") });      if (message.shippingCountry) {        params.set("ship_to_country", message.shippingCountry);      }      // The product URLs you're currently viewing, plus your two-letter      // shipping country, are sent to the developer's own Cloudflare Worker.      const res = await fetch(`https://link-improver.johnnyaug.workers.dev/?${params}`);      const rewritten = await res.json();      if (rewritten && Object.keys(rewritten).length > 0) {        const stillMissing = uncachedUrls.filter(u => !rewritten[u]);        cacheImprovedUrls(rewritten, stillMissing);        improvedUrls = { ...improvedUrls, ...rewritten };      }    }    sendResponse({ improvedUrls });  } catch {    trackEvent("improve_link_failed");    sendResponse({});  }  break;
Where the data goes
    • link-improver.johnnyaug.workers.dev

    A Cloudflare Worker that appears developer-operated (subdomain matches the developer's handle 'johnnyaug'); receives product URLs and shipping country, returns rewritten links.

Where it sends data

Destinations our analysis observed Skip AliExpress Bundle Deals: Just This One! contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • link-improver.johnnyaug.workers.dev

    Skip AliExpress Bundle Deals: Just This One! sends data to link-improver.johnnyaug.workers.dev. No other extension we have analysed sends data here.

Updated 30 September 2026hmanabkkmjohmoedpiomdgdknpdjhphi