⛔ Malware Advisory Detected 2026-09-26
Confirmed malicious. codelake independently detected this at 2026-09-26 — codelake catch — already scanned in the codelake corpus (AMO recent feed, 2026-09-25); confirmed malicious on manual flag-safe review during the alihelp.xyz campaign sweep after CLR-2026-3054. Firefox add-ons are not covered by OSV; reported to Mozilla AMO.. Not yet in any public advisory database at detection time — codelake is the source of record. Static code + dataflow review of the published .xpi; no execution.
Advisory · CLR-2026-3057

AliExpress Rating & Fake Review Checker — a Firefox add-on that hijacks AliExpress affiliate commissions and reports your product clicks to alihelp.xyz, while declaring it collects no data

[email protected] (v1.4.6) shows seller trust scores, but also strips affiliate tags and re-asserts its own s.click.aliexpress.com deep link (connected_by=alihelp, key _c4WvcFkP), and POSTs each product click to alihelp.xyz/api/track — while its manifest declares data_collection: { required: ['none'] }.

MediumConfirmed maliciouscodelake first-catch
What it is & how it works

AliExpress Rating & Fake Review Checker (ID [email protected]) computes a seller “trust score”. It also carries the campaign's affiliate hijack and product-click telemetry, structurally identical to the other AliHelp add-ons. Its own AMO listing description reuses the phrase “AliHelp gives every AliExpress product…”.

Commission hijack. src/background.js uses the same stripAffiliateParams() → scheduleRedirect() → chrome.scripting.executeScript chain to force location.href to its own s.click.aliexpress.com deep link, up to 5× per tab. Consent is captured through a dark-pattern “OK, Got it” tutorial in src/content.js.

Undisclosed telemetry. trackProductClick() beacons {type:'product_click', …, referrer} to alihelp.xyz/api/track, and the add-on fetches the Alibaba cna device cookie (credentials:'include') and an exchange-rate API — all while declaring it requires no data collection.

How we found it

This surfaced during the campaign sweep that followed CLR-2026-3054 (AliHelp). Reviewing the same publisher — Shadow Code (AMO user 20125879) — we found all four of its AliExpress add-ons already sitting scanned in the codelake corpus, ingested from the AMO recent feed on 2026-09-25, each carrying the same affiliate-redirect machinery. Detection was never the gap here; surfacing was.

Confirmed on manual, flag-safe static review of the published .xpi — reading background.js/bg.js and the content scripts, no execution. This advisory is part of the alihelp.xyz / Shadow Code affiliate-hijack campaign (CLR-2026-3058).

Affected versions

Analysed: 1.4.6 (alihelp_product_trust_score-1.4.6.xpi). The affiliate-hijack logic is core to the add-on across its releases.

Timeline
2026-09-25
Ingested & scanned
Pulled from the AMO recent feed into the codelake corpus; scanners flagged the affiliate-redirect machinery.
2026-09-26
codelake catch
Confirmed malicious on flag-safe static review during the alihelp.xyz campaign sweep.
2026-09-26
Advisory published
CLR-2026-3057 published; reported to Mozilla AMO. Part of campaign CLR-2026-3058.
Indicators of compromise
🧩Firefox add-on ID: [email protected] — “AliExpress Rating & Fake Review Checker” v1.4.6
🌐Telemetry endpoint: https://alihelp.xyz/api/track · config: alihelp.xyz/api/ext/config
🔗Injected affiliate deep link: s.click.aliexpress.com/deep_link.htm?aff_short_key=_c4WvcFkP&…&connected_by=alihelp
📦Package file: alihelp_product_trust_score-1.4.6.xpi
🧠Code markers: stripAffiliateParams(), scheduleRedirect(), trackProductClick(), Alibaba cna cookie fetch (credentials:'include')
Remediation
#ActionPriority
1 Remove the add-on from Firefox (about:addons). Immediate
2 If you shop AliExpress via a creator's affiliate link, re-open it fresh after removal so the intended creator is credited. Advised
3 Report the add-on to Mozilla Add-ons (AMO) for policy review. Advised

Verified by static code + dataflow review of the published .xpi; no execution, no live callback.

Scope: AliExpress + Alibaba + alihelp.xyz; redirect gated behind a dark-pattern tutorial, telemetry is not.