[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Alitools Shopping Assistant

Version 26.1.1.17785 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: https://alitools.io/

Rating: 4.5 ★ (3.6K ratings)

Users: 400,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: The extension has a substantial user base of 400,000 users and a solid 4.5-star rating from 3,600 reviews, indicating general user satisfaction. The developer maintains a dedicated website (alitools.io) which suggests some level of legitimacy. However, these positive indicators are overshadowed by the extensive permissions requested.

Concerns: This shopping assistant extension requests an alarming array of powerful permissions that far exceed what's necessary for typical shopping assistance functionality. The combination of cookies access, web request interception, broad host permissions, and content script injection across all websites creates a perfect storm for potential data harvesting. The extension can essentially monitor, intercept, and modify all your web traffic, access stored login credentials through cookies, and inject code into every website you visit. For a shopping tool, these capabilities are excessive and concerning.

The webNavigation permission allows complete tracking of your browsing patterns, while the webRequest permission enables the extension to intercept and potentially modify sensitive data like payment information, personal details, and login credentials across all websites.

Recommendations: Given the critical risk level, avoid installing this extension on your primary browser profile. If you must use it, create a dedicated Chrome profile specifically for shopping activities, ensure no sensitive accounts are logged in on that profile, and regularly clear cookies and browsing data. Consider alternative shopping extensions with more limited permissions, or use the retailer's official apps instead.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

contextMenus
cookies
notifications
tabs
webNavigation
storage
scripting
alarms
webRequest

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (139 total):

https://addons.mozilla.org/ru/firefox/addon/ali-tools/privacy/	http://www.w3.org/2000/svg
https://addons.mozilla.org/firefox/addon/ali-tools/privacy/	https://alitools.io/
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	https://fengyuanchen.github.io/cropperjs
https://api.alitools.io	https://alitools-static.s3-eu-west-1.amazonaws.com/extension/
https://ext.alitools.io	https://my.alitools.io
https://alitools.io	https://alitools.link
https://cnf-u45p-alitools.com	https://aliexitem.com/go
https://share.alitools.io	https://aliexpress.com
https://aliexpress.ru	https://967e2cbba85943da8ae930fa60f71ca4@sentry.srv.alitools.ru/29
https://shoppingcart.aliexpress.ru/shopcart/shopcartDetail.htm	https://my.aliexpress.ru/wishlist/wish_list_product_list.htm
https://shoppingcart.aliexpress.com/shopcart/shopcartDetail.htm	https://my.aliexpress.com/wishlist/wish_list_product_list.htm
https://beru.ru/my/cart	https://beru.ru/wishlist
https://www.mvideo.ru/cart	https://www.mvideo.ru/wish-list
https://market.yandex.ru/my/wishlist	https://my.rozetka.com.ua/cart/
https://my.rozetka.com.ua/profile/wishlists/	https://www.eldorado.ru/personal/basket.php
https://www.eldorado.ru/personal/wish-list/	https://www.citilink.ru/order/
https://citilink.ru/profile/wishlist/	https://svyaznoy.ru/cart/
https://svyaznoy.ru/favorite-product	https://www.lamoda.ru/checkout/cart/
https://www.lamoda.ru/wishlist/	https://www.lamoda.kz/checkout/cart/
https://www.lamoda.kz/wishlist/	https://www.lamoda.by/checkout/cart/
https://www.lamoda.by/wishlist/	https://www.lamoda.ua/checkout/cart/
https://www.lamoda.ua/wishlist/	https://www.sportmaster.ru/basket/checkout.do
https://www.sportmaster.ru/profile/wishlist/	https://www.joom.com/cart
https://www.joom.com/favorites	https://www.banggood.com/shopping_cart.html
https://www.banggood.com/index.php?com=account&t=wishlist	https://www.220-volt.ru/order/
https://www.220-volt.ru/profile/favorites/	https://leroymerlin.ru/basket/
https://leroymerlin.ru/shopping-list/	https://megamarket.ru/multicart/
https://www.asos.com/bag	https://www.asos.com/saved-lists/
https://www.asos.de/bag	https://www.asos.de/saved-lists/
https://www.asos.fr/bag	https://www.asos.fr/saved-lists/
https://www.vseinstrumenti.ru/cart/	https://www.vseinstrumenti.ru/user/favorites/
https://ru-mi.com/checkout/	https://ru-mi.com/wishlist/
https://www.farfetch.com/checkout/basket.aspx	https://www.farfetch.com/wishlist
https://www.bonprix.pl/cart.htm	https://www.bonprix.pl/mywishlist.htm
https://allegro.pl/koszyk	https://allegro.pl/moje-allegro/zakupy/obserwowane/oferty
https://www.alternate.de/html/cart.html	https://www.amazon.com/gp/cart/view.html?ref_=nav_cart
https://www.amazon.de/gp/cart/view.html?ref_=nav_cart	https://www.amazon.ca/gp/cart/view.html?ref_=nav_cart
https://www.amazon.cn/gp/cart/view.html?ref_=nav_cart	https://www.amazon.co.jp/gp/cart/view.html?ref_=nav_cart

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_EXTENSION_NAME__",
  "icons": {
    "32": "assets/icons/32_ny.png",
    "128": "assets/icons/128_ny.png"
  },
  "action": {
    "default_icon": "assets/icons/32_ny.png",
    "default_popup": "popup.html"
  },
  "version": "26.1.1.17785",
  "background": {
    "service_worker": "background.js"
  },
  "short_name": "Alitools",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_EXTENSION_DESCRIPTION__",
  "permissions": [
    "contextMenus",
    "cookies",
    "notifications",
    "tabs",
    "webNavigation",
    "storage",
    "scripting",
    "alarms",
    "webRequest"
  ],
  "homepage_url": "https://alitools.io",
  "options_page": "settings.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "common-react.js",
        "content-all-sites.js"
      ],
      "css": [
        "assets/styles/fonts.css",
        "assets/styles/common-react.css",
        "assets/styles/content-all-sites.css"
      ],
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "97",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "assets/fonts/*"
      ]
    }
  ]
}

by ✦ Astarte

Alitools Shopping Assistant

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (139 total):

Raw Manifest

Detections

Manifest Findings