⛔ Malware Advisory Detected 2026-09-26
Confirmed malicious. codelake independently detected this at 2026-09-26 — codelake catch — already scanned in the codelake corpus (AMO recent feed, 2026-09-25); confirmed malicious on manual flag-safe review during the alihelp.xyz campaign sweep after CLR-2026-3054. Firefox add-ons are not covered by OSV; reported to Mozilla AMO.. Not yet in any public advisory database at detection time — codelake is the source of record. Static code + dataflow review of the published .xpi; no execution.
Advisory · CLR-2026-3056

AliExpress Image and Video Downloader — a Firefox add-on that hijacks AliExpress affiliate commissions and reports your product clicks to alihelp.xyz, while declaring it collects no data

[email protected] (v2.3.4) strips affiliate tags already on the URL and re-asserts its own s.click.aliexpress.com deep link via chrome.scripting.executeScript (Referer-preserving, up to 5×/tab), and POSTs each product click to alihelp.xyz/api/track — while its manifest declares data_collection: { required: ['none'] }.

MediumConfirmed maliciouscodelake first-catch
What it is & how it works

AliExpress Image and Video Downloader (ID [email protected]) does download product media. It also runs the campaign's affiliate hijack and product-click telemetry.

Commission hijack. tryTagTab() calls stripAffiliateParams() to remove affiliate parameters already on the URL — including other creators' tags — then scheduleRedirect() forces location.href to its own s.click.aliexpress.com deep link (connected_by=alihelp, key _c4WvcFkP) via chrome.scripting.executeScript. The code comments state the in-page navigation is used specifically so the redirect keeps the Referer and beats a competitor's redirect. The redirect is gated behind an affiliate_consent modal (content_consent.js) — a dark-pattern fig-leaf.

Undisclosed telemetry. trackProductClick() sends {type:'product_click', extension:'AliHelp Image & Video Downloader', slug/title=productUrl, referrer=pageUrl} to alihelp.xyz/api/track via navigator.sendBeacon. The manifest nonetheless declares it requires no data collection. A code comment references alihelp.xyz/admin's “Extension affiliate ID pool” and a shared alihelp-web lib/extensions.js — i.e. a centrally-managed, multi-extension operation.

How we found it

This surfaced during the campaign sweep that followed CLR-2026-3054 (AliHelp). Reviewing the same publisher — Shadow Code (AMO user 20125879) — we found all four of its AliExpress add-ons already sitting scanned in the codelake corpus, ingested from the AMO recent feed on 2026-09-25, each carrying the same affiliate-redirect machinery. Detection was never the gap here; surfacing was.

Confirmed on manual, flag-safe static review of the published .xpi — reading background.js/bg.js and the content scripts, no execution. This advisory is part of the alihelp.xyz / Shadow Code affiliate-hijack campaign (CLR-2026-3058).

Affected versions

Analysed: 2.3.4 (aliexpress_media_downloader-2.3.4.xpi). The affiliate-hijack logic is core to the add-on across its releases.

Timeline
2026-09-25
Ingested & scanned
Pulled from the AMO recent feed into the codelake corpus; scanners flagged the affiliate-redirect machinery.
2026-09-26
codelake catch
Confirmed malicious on flag-safe static review during the alihelp.xyz campaign sweep.
2026-09-26
Advisory published
CLR-2026-3056 published; reported to Mozilla AMO. Part of campaign CLR-2026-3058.
Indicators of compromise
🧩Firefox add-on ID: [email protected] — “AliExpress Image and Video Downloader” v2.3.4
🌐Telemetry endpoint: https://alihelp.xyz/api/track (product_click beacons) · config: alihelp.xyz/api/ext/config
🔗Injected affiliate deep link: s.click.aliexpress.com/deep_link.htm?aff_short_key=_c4WvcFkP&…&connected_by=alihelp
📦Package file: aliexpress_media_downloader-2.3.4.xpi
🧠Code markers: stripAffiliateParams(), scheduleRedirect(), trackProductClick(), REASSERT_DELAY_MS, MAX_ATTEMPTS_PER_TAB
Remediation
#ActionPriority
1 Remove the add-on from Firefox (about:addons). Immediate
2 If you shop AliExpress via a creator's affiliate link, re-open it fresh after removal so the intended creator is credited. Advised
3 Report the add-on to Mozilla Add-ons (AMO) for policy review. Advised

Verified by static code + dataflow review of the published .xpi; no execution, no live callback.

Scope: AliExpress domains + alihelp.xyz; redirect gated behind a dark-pattern consent modal, telemetry is not.