Is Track24.ru safe?

High risk

Track24.ru fetches and executes remote JavaScript from api.track24.ru on AliExpress order pages without any integrity check.

When a user visits AliExpress order list pages, the extension's content script retrieves a JavaScript file from api.track24.ru and evaluates it directly using eval(). The evaluated code runs in content-script scope with access to the Chrome extension runtime. The extension also ships a hardcoded API key in its bundle, which is transmitted to api.track24.ru with every package tracking request.

Track24v1.0.8Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Track24.ru evaluates remote code on AliExpress order pages

Track24.ru runs on every HTTP/HTTPS page, then on matching AliExpress order-list pages fetches JS from api.track24.ru/extension/appKey.php and passes it to eval().

Dynamic analysis missed this call, as AliExpress redirected to login first.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open an AliExpress order-list page.

The branch requires an AliExpress order-list URL and order-row elements in the page.

The extension did this

The extension asks api.track24.ru for JavaScript and runs the response.

The code assigns appKey and cp from the evaluated response, then continues processing order rows.

02EvidenceFIELD TABLE
Concrete conditions and values used by this branch
FieldValueWhy it matters
AliExpress order URL
https://trade.aliexpress.com/orderList.htmThis limits the remote-code branch to order-list pages you visit.
Order-row selector
.order-body or .OrderList_OrderItem__productItemWrap__The extension waits for order-list content before requesting the remote script.
Remote script endpoint
https://api.track24.ru/extension/appKey.phpThis host supplies the JavaScript text that the extension runs on the order page.
Values assigned by the response
appKey and cpThe response is expected to define values the extension reuses for later tracking requests.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://api.track24.ru/extension/appKey.php
Dynamic analysis did not observe this request because AliExpress redirected to a login page before the order-list DOM rendered.
04EvidenceCODE COMPARE
The code that does this

The shipped branch that fetches and evaluates appKey.php

What it actually does
Content script runs on every HTTP and HTTPS pagedeobfuscated/manifest.json
"content_scripts": [
   {
      "matches": ["http://*/*", "https://*/*"],
      "css": ["css/style.css", "css/font-awesome.min.css", "css/simpleTooltips.css", "css/animate.min.css", "css/price.css"],
      "js": ["js/jquery-latest.js", "js/content.js", "js/aes.js", "js/simpleTooltips.js", "js/jquery.storage.js", "js/chart.min.js", "js/price.js"] 
    }
]
AliExpress order-list gate and remote evaldeobfuscated/js/content.js
if ((document.location.href.indexOf("trade.aliexpress.com/order_list.htm") > 0) || (document.location.href.indexOf("trade.aliexpress.com/orderList") > 0) || (document.location.href.indexOf("trade.aliexpress.ru/orderList.htm") > 0) ){
      var regExpPattern = /OrderList_OrderItem__productItemWrap__(\w{4,10})/; 
	  var match = regExpPattern.exec($("body").html());
	      orderV2RowClass = (match !== null) ? ".OrderList_OrderItem__productItemWrap__"+match[1] : null;
		  
	   if ((($('.order-body').length) > 0) || (($(orderV2RowClass).length) > 0)) { 
		    $.get("https://api.track24.ru/extension/appKey.php", function(data) {
				eval(data);
				n_appKey = appKey;
				n_cp = cp; 
				 
				renderLastEventsWrapperElements();
					 
				 $(".OrderList_ButtonLoadMore__loadMoreBtn__1vphe").click(function(e) {
				  e.preventDefault();
					 setTimeout(function() {
						 renderLastEventsWrapperElements();								 
					 }, 1500); 
				 });
					 
            });
        }
	}
05EvidenceTHIRD PARTY LIST
Hosts involved in this order-page flow
  • api.track24.ru

    Receives the appKey.php request and returns JavaScript that the content script evaluates.

  • aliexpress.ru

    Receives order-tracking history requests from the background script after an order ID is extracted from the page.

Data recipients

api.track24.ru
Updated 17 September 2026lfijgegefgcgbfcgjgnhnkclenhfijhk