AliHelp — a Firefox “AliExpress shopping assistant” that hijacks affiliate commissions and tracks your shopping

AliHelp – AliExpress Shopping Assistant is a Firefox add-on (ID [email protected]) scoped to AliExpress domains (com/us/ru/fr/es/pt/de/ar). It presents as a price/seller-trust helper, and it does contain a genuine “find similar/cheaper” feature that queries Alibaba’s image-search API. But its background logic is an affiliate-commission hijacker.

Commission hijacking. On AliExpress product, store and cart pages, tryTagTab() calls stripAffiliateParams() to strip affiliate parameters already present on the URL — i.e. other creators’ affiliate tags — then calls scheduleRedirect(), which after ~900 ms uses chrome.scripting.executeScript to force location.href to its own s.click.aliexpress.com/deep_link.htm?aff_short_key=<its key>&dl_target_url=<product>. It skips only if its own key is already present, and re-asserts up to 5× per tab (MAX_ATTEMPTS_PER_TAB). The net effect: whoever’s affiliate link the user actually followed is overwritten, and the commission is redirected to AliHelp.

Undisclosed tracking. trackProductClick() POSTs {type:'product_click', product URL, referrer} to alihelp.xyz/api/ext on each click — the user’s AliExpress product-viewing behaviour, sent to the operator’s server without disclosure.

The add-on was pulled into codelake’s Firefox-extension scan feed and flagged by mosaic (assembled affiliate URLs in background.js/content_affiliate.js), extscan (browsing-data telemetry) and pkgbehavior (hidden fetch). It was confirmed on manual, flag-safe static review of the published .xpi — reading the redirect and telemetry logic, no execution.

Two signals we deliberately did not treat as compromise: an extscan “cookie-exfil” hit is a false positive — the only cookie access is Alibaba’s cna device cookie fetched from open-s.alibaba.com/foundation/generateCna to drive the legitimate Alibaba product-search feature, not the user’s login/session; and the extension holds no <all_urls> access — its reach is limited to AliExpress. The harm is affiliate fraud + shopping telemetry, not account theft.

Analysed: 2.0.5 (aliexpress_shopping_assistant-2.0.5.xpi). The hijack + telemetry logic is core to the add-on; earlier releases are very likely affected as well.