Is Taobao Shopping Cart Assistant - One-click Export Product List safe?
Taobao Shopping Cart Assistant uploads product page details from 30+ marketplaces to index.aiprice.com as you browse.
On supported shopping sites such as 1688, Tmall, Shopee, eBay, Temu and Shein, the extension reads the product URL, title, price, SKU, shop, order count and image and sends them to index.aiprice.com every few seconds, with no consent prompt. Its content script also accepts messages from any web page that can make it fetch an image from a page-chosen URL and upload it to api.aiprice.com for image search.
Who publishes itJim - 11 other listings from the same operator, none carrying a finding
Jim - 11 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
11 other listings published from this account, 2k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
AliPrice uploads marketplace product page data to index.aiprice.com
Code analysis shows product details (URL, title, price, SKU, shop, order count) from shopping pages are posted to index.aiprice.com every 2 seconds while parsed, with no consent step.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a product or listing page on a supported marketplace.
The extension parses the product and sends it to index.aiprice.com via its background worker.
- Product page URLhttps://detail.1688.com/offer/712345678901.html
Shows which item you were looking at.
- Title and imageWireless bluetooth earphones, black
Describes the product on screen.
- Price and currencyCNY 12.50 (min 11.80, max 14.00)
The price shown to you on the page.
- SKU and shopsku_id 712345678901, shop_name Example Trading Co
Identifies the product and seller.
- Extension and browser infobrowser chrome, version 5.0.1, adid
Identifies the extension build sending it.
Per-platform request builder for 1688 product pages
Builds the POST body from the parsed product
// config.url is the AliPrice base (index.aiprice.com) + "/plugin/item_1688.php"getHttpConfigure(product) { body.url = product.link; body.title = product.title; body.picture = first image URL; body.price/minPrice/maxPrice = parsed prices; body.sku_id = product.skuId; body.shop_id/shop_name/shop_url = seller; body.orders_num = rating count; body.browser = "chrome"; body.version = "5.0.1"; return request config;}Upload timers started when the uploader mounts
Readable form
parseThePage();setInterval(() => upload({ trigger: "normal" }), 2000);const finalUploadDelay = pageType === "details" ? 5000 : 20000;// then a timeout upload with trigger "timeout"- index.aiprice.com
Receives product records from the browser; base host set in content-script.js and background.js.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Taobao Shopping Cart Assistant - One-click Export Product List contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.aiprice.com
Taobao Shopping Cart Assistant - One-click Export Product List sends data to api.aiprice.com. 24 other extensions we have analysed send data here.
- index.aiprice.com
Taobao Shopping Cart Assistant - One-click Export Product List sends data to index.aiprice.com. 8 other extensions we have analysed send data here.