⛔ Malware Advisory Detected 2026-09-26
Confirmed malicious. codelake independently detected this at 2026-09-26 — codelake catch — already scanned in the codelake corpus (AMO recent feed, 2026-09-25); confirmed malicious on manual flag-safe review during the alihelp.xyz campaign sweep after CLR-2026-3054. Firefox add-ons are not covered by OSV; reported to Mozilla AMO.. Not yet in any public advisory database at detection time — codelake is the source of record. Static code + dataflow review of the published .xpi; no execution.
Advisory · CLR-2026-3055

Search by Image: AliExpress & Alibaba — a Firefox add-on that silently hijacks AliExpress affiliate commissions with no consent, and requests access to every site you visit

[email protected] (v2.2.1) provides a genuine reverse-image search, but its bg.js also runs an ungated affiliate hijack: on any AliExpress item/store/cart page it forces a redirect to its own s.click.aliexpress.com deep link (connected_by=alihelp, key _c4WvcFkP) up to 5× per tab — with no consent gate at all — and its manifest requests <all_urls> host access.

MediumConfirmed maliciouscodelake first-catch
What it is & how it works

Search by Image: AliExpress & Alibaba (ID [email protected]) offers a real reverse-image search against Alibaba/AliExpress. That feature works. The problem is a second, undisclosed behaviour in bg.js.

Ungated commission hijack. A chrome.tabs.onUpdated listener fires on every AliExpress item/store/cart/category page and — without any consent check — redirects the tab to https://s.click.aliexpress.com/deep_link.htm?aff_short_key=_c4WvcFkP&dl_target_url=<page>&connected_by=alihelp, retrying up to 5× per tab (MAX_ATTEMPTS_PER_TAB, REASSERT_DELAY_MS=900). Any affiliate credit the user's visit would have earned is redirected to this operator. Unlike its sibling add-ons, there is no consent modal in front of this.

Over-broad access. The manifest requests <all_urls> — access to every site the user visits — far beyond what a reverse-image tool scoped to AliExpress needs.

How we found it

This surfaced during the campaign sweep that followed CLR-2026-3054 (AliHelp). Reviewing the same publisher — Shadow Code (AMO user 20125879) — we found all four of its AliExpress add-ons already sitting scanned in the codelake corpus, ingested from the AMO recent feed on 2026-09-25, each carrying the same affiliate-redirect machinery. Detection was never the gap here; surfacing was.

Confirmed on manual, flag-safe static review of the published .xpi — reading background.js/bg.js and the content scripts, no execution. This advisory is part of the alihelp.xyz / Shadow Code affiliate-hijack campaign (CLR-2026-3058).

Affected versions

Analysed: 2.2.1 (alihelp_search_by_image-2.2.1.xpi). The affiliate-hijack logic is core to the add-on across its releases.

Timeline
2026-09-25
Ingested & scanned
Pulled from the AMO recent feed into the codelake corpus; scanners flagged the affiliate-redirect machinery.
2026-09-26
codelake catch
Confirmed malicious on flag-safe static review during the alihelp.xyz campaign sweep.
2026-09-26
Advisory published
CLR-2026-3055 published; reported to Mozilla AMO. Part of campaign CLR-2026-3058.
Indicators of compromise
🧩Firefox add-on ID: [email protected] — “Search by Image: AliExpress & Alibaba” v2.2.1
🔗Injected affiliate deep link: s.click.aliexpress.com/deep_link.htm?aff_short_key=_c4WvcFkP&…&connected_by=alihelp
⚠️Over-broad host permission: <all_urls>
📦Package file: alihelp_search_by_image-2.2.1.xpi
🧠Code markers: AFF_SHORT_KEY='_c4WvcFkP', REASSERT_DELAY_MS, MAX_ATTEMPTS_PER_TAB, chrome.tabs.onUpdated (ungated)
Remediation
#ActionPriority
1 Remove the add-on from Firefox (about:addons). Immediate
2 If you shop AliExpress via a creator's affiliate link, re-open it fresh after removal so the intended creator is credited. Advised
3 Report the add-on to Mozilla Add-ons (AMO) for policy review. Advised

Verified by static code + dataflow review of the published .xpi; no execution.

No alihelp.xyz telemetry observed in this add-on — its violation is the silent, consent-less affiliate hijack plus the request.