Is Skip AliExpress Bundle Deals: Just This One! safe?
Skip AliExpress Bundle Deals: Just This One! sends AliExpress product URLs and shipping country to a developer Worker.
On AliExpress pages, the extension collects product URLs from BundleDeals and wishlist links and reads the shipping country from the aep_usuc_f cookie. It sends those URLs and the country code to a developer Cloudflare Worker to receive rewritten product links.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliExpress deal-finder sends product links and shipping country to developer
On AliExpress pages with deal links, the extension sends the product URLs you're viewing and your two-letter shipping country to a Cloudflare Worker the developer runs, which returns rewritten links.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open an AliExpress page that has BundleDeals or wishlist product links on it.
The content script rescans the page for these links roughly once a second.
The extension sends those product URLs and your shipping country to a Cloudflare Worker the developer controls.
The Worker replies with rewritten versions of the links, which the extension caches and swaps in.
200 OK, returning a JSON map of each URL to a rewritten link, which the extension caches. Product URLs here are illustrative; ship_to_country=UK is the exact captured value.
- Product page linkshttps://www.aliexpress.com/item/1005006109951192.html, https://www.aliexpress.com/item/1005005432112233.html
The AliExpress product pages currently shown to you in a BundleDeals or wishlist list.
- Shipping country codeUK
The two-letter country your AliExpress account ships to, read from a site cookie.
Collecting links and country, then requesting the Worker
Queueing links and sending them to the background (content-0.js)
content_scripts/content-0.jsfunction queueLinkForClickTracking(anchorEl, productUrl, clickSource) { pendingProductUrls.push(productUrl); anchorEl.addEventListener("click", async () => { browser.runtime.sendMessage({ type: "ELEMENT_LINK_CLICKED", new_url: improvedLinkCache[productUrl] || productUrl, is_improved: productUrl in improvedLinkCache, click_source: clickSource }); });}async function flushQueuedLinksToBackground() { if (pendingProductUrls.length === 0) return; const urlsToImprove = [...pendingProductUrls]; pendingProductUrls.length = 0; const response = await browser.runtime.sendMessage({ type: "IMPROVE_LINK", productUrls: urlsToImprove, shippingCountry: readShippingCountryFromCookie() }); if (response && response.improvedUrls) { Object.assign(improvedLinkCache, response.improvedUrls); }}function readShippingCountryFromCookie() { // aep_usuc_f is AliExpress's own site cookie for locale/shipping settings. const cookie = document.cookie.split("; ").find(c => c.startsWith("aep_usuc_f=")); if (cookie) { const match = cookie.match(/region=([A-Z]{2})/); if (match) return match[1]; // e.g. "UK", "US" } return null;}// Re-scan the page for BundleDeals/wishlist product links every second,// then flush anything newly found to the background service worker.scanPageForDealLinks();setInterval(scanPageForDealLinks, 1000);Building the request to the Worker (service_worker.js)
background/service_worker.jscase "IMPROVE_LINK": try { await refreshAffiliateProbeStatus(); const mode = await getAffiliateLinkMode(); // ALLOWED | BLOCKED | ONLY_LOCAL if (mode === LinkMode.BLOCKED) { sendResponse({ improvedUrls: {} }); break; } // Check the local cache first so repeat views of the same product // don't trigger a new network request. const { results: cachedUrls, missing: uncachedUrls } = await readCachedImprovedUrls(message.productUrls); let improvedUrls = { ...cachedUrls }; if (mode === LinkMode.ONLY_LOCAL) { sendResponse({ improvedUrls }); break; } if (uncachedUrls.length > 0) { const params = new URLSearchParams({ product_urls: uncachedUrls.join(",") }); if (message.shippingCountry) { params.set("ship_to_country", message.shippingCountry); } // The product URLs you're currently viewing, plus your two-letter // shipping country, are sent to the developer's own Cloudflare Worker. const res = await fetch(`https://link-improver.johnnyaug.workers.dev/?${params}`); const rewritten = await res.json(); if (rewritten && Object.keys(rewritten).length > 0) { const stillMissing = uncachedUrls.filter(u => !rewritten[u]); cacheImprovedUrls(rewritten, stillMissing); improvedUrls = { ...improvedUrls, ...rewritten }; } } sendResponse({ improvedUrls }); } catch { trackEvent("improve_link_failed"); sendResponse({}); } break;- link-improver.johnnyaug.workers.dev
A Cloudflare Worker that appears developer-operated (subdomain matches the developer's handle 'johnnyaug'); receives product URLs and shipping country, returns rewritten links.
Where it sends data
Destinations our analysis observed Skip AliExpress Bundle Deals: Just This One! contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- link-improver.johnnyaug.workers.dev
Skip AliExpress Bundle Deals: Just This One! sends data to link-improver.johnnyaug.workers.dev. No other extension we have analysed sends data here.