Am I Being Pwned?
Get started

Is Track24.ru safe?

High risk

Track24.ru fetches and executes remote JavaScript from api.track24.ru on AliExpress order pages without any integrity check.

When a user visits AliExpress order list pages, the extension's content script retrieves a JavaScript file from api.track24.ru and evaluates it directly using eval(). The evaluated code runs in content-script scope with access to the Chrome extension runtime. The extension also ships a hardcoded API key in its bundle, which is transmitted to api.track24.ru with every package tracking request.

Track24v1.0.8Chrome Web Store
73Risk
Who publishes it

Track24 - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Track24
Website
forum.track24.ru/index.php?threads/%D0%A0%D0%B0%D1%81%D1%88%D0%B8%D1%80%D0%B5%D0%BD%D0%B8%D0%B5-%D0%B4%D0%BB%D1%8F-%D0%BE%D1%82%D1%81%D0%BB%D0%B5%D0%B6%D0%B8%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F-%D0%BF%D0%BE%D1%87%D1%82%D0%BE%D0%B2%D1%8B%D1%85-%D0%BE%D1%82%D0%BF%D1%80%D0%B0%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B9.40/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Track24.ru evaluates remote code on AliExpress order pages

HighunwantedCWE-829Dynamic sandbox

Track24.ru runs on every HTTP/HTTPS page, then on matching AliExpress order-list pages fetches JS from api.track24.ru/extension/appKey.php and passes it to eval().

What actually happens

You did this

You open an AliExpress order-list page.

The branch requires an AliExpress order-list URL and order-row elements in the page.

The extension did this

The extension asks api.track24.ru for JavaScript and runs the response.

The code assigns appKey and cp from the evaluated response, then continues processing order rows.

Concrete conditions and values used by this branch

  • AliExpress order URL
    https://trade.aliexpress.com/orderList.htm

    This limits the remote-code branch to order-list pages you visit.

  • Order-row selector
    .order-body or .OrderList_OrderItem__productItemWrap__

    The extension waits for order-list content before requesting the remote script.

  • Remote script endpoint
    https://api.track24.ru/extension/appKey.php

    This host supplies the JavaScript text that the extension runs on the order page.

  • Values assigned by the response
    appKey and cp

    The response is expected to define values the extension reuses for later tracking requests.

Captured request

GEThttps://api.track24.ru/extension/appKey.php

Dynamic analysis did not observe this request because AliExpress redirected to a login page before the order-list DOM rendered.

The code that does this

The shipped branch that fetches and evaluates appKey.php

Readable version

Content script runs on every HTTP and HTTPS page

deobfuscated/manifest.json
"content_scripts": [   {      "matches": ["http://*/*", "https://*/*"],      "css": ["css/style.css", "css/font-awesome.min.css", "css/simpleTooltips.css", "css/animate.min.css", "css/price.css"],      "js": ["js/jquery-latest.js", "js/content.js", "js/aes.js", "js/simpleTooltips.js", "js/jquery.storage.js", "js/chart.min.js", "js/price.js"]     }]

AliExpress order-list gate and remote eval

deobfuscated/js/content.js
if ((document.location.href.indexOf("trade.aliexpress.com/order_list.htm") > 0) || (document.location.href.indexOf("trade.aliexpress.com/orderList") > 0) || (document.location.href.indexOf("trade.aliexpress.ru/orderList.htm") > 0) ){      var regExpPattern = /OrderList_OrderItem__productItemWrap__(\w{4,10})/; 	  var match = regExpPattern.exec($("body").html());	      orderV2RowClass = (match !== null) ? ".OrderList_OrderItem__productItemWrap__"+match[1] : null;		  	   if ((($('.order-body').length) > 0) || (($(orderV2RowClass).length) > 0)) { 		    $.get("https://api.track24.ru/extension/appKey.php", function(data) {				eval(data);				n_appKey = appKey;				n_cp = cp; 				 				renderLastEventsWrapperElements();					 				 $(".OrderList_ButtonLoadMore__loadMoreBtn__1vphe").click(function(e) {				  e.preventDefault();					 setTimeout(function() {						 renderLastEventsWrapperElements();								 					 }, 1500); 				 });					             });        }	}

Hosts involved in this order-page flow

    • api.track24.ru

    Receives the appKey.php request and returns JavaScript that the content script evaluates.

    • aliexpress.ru

    Receives order-tracking history requests from the background script after an order ID is extracted from the page.

What it can do

Permissions this extension asks for, as declared in version 1.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed Track24.ru contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.track24.ru

    Track24.ru sends data to api.track24.ru. No other extension we have analyzed sends data here.

Updated 30 September 2026lfijgegefgcgbfcgjgnhnkclenhfijhk