Anubis — AliExpress price tracker

Every product page visit by a logged-in AliExpress user results in the full `snapshot` object — containing `productId`, `productName`, `price`, `shippingCost`, `currency`, `domain`, `language`, `variant` (selected SKU options), and the full product `url` — being POSTed to the operator-controlled server at `anubisprice.duckdns.org`. The DuckDNS domain is a free dynamic-DNS service typically used to obscure or frequently change the actual server IP, which is atypical for a legitimate commercial SaaS backend. Combined with the persistent install UUID in the header, this call constitutes systematic exfiltration of the user's AliExpress browsing and purchase-intent data to a third-party server the user has no relationship with.

if (t.type === "postObservation") {  let e = await l(),    s = await fetch(`${a}/v1/observations`, {      method: "POST",      headers: {        "Content-Type": "application/json",        "X-Anubis-Install-Id": e      },      body: JSON.stringify(t.snapshot)    });  if (!s.ok) {    let n = await s.text()      .catch(() => "");    throw new Error(`POST /v1/observations ${s.status}: ${n}`)  }  return await s.json()}

The extension generates a persistent UUID (`anubis_install_id`) stored in `chrome.storage.local` on first run and reuses it indefinitely. This identifier is attached to every outbound network request via the `X-Anubis-Install-Id` header, creating a durable cross-session fingerprint that allows the operator at `anubisprice.duckdns.org` to correlate every AliExpress product page visited by a specific browser profile over time. Unlike a session cookie, this UUID survives browser restarts and profile clears of transient state.

var a = "https://anubisprice.duckdns.org";var i = "anubis_install_id",  c = null,  r = null;async function l() {  return c || r || (r = (async () => {    let e = (await chrome.storage.local.get(i))[i];    return e || (e = crypto.randomUUID(), await chrome.storage.local.set({      [i]: e    })), c = e, e  })(), r)}

The `extract()` function assembles a snapshot that includes the full canonical product URL alongside the product name, price, shipping cost, selected variant (SKU combination), language, and the AliExpress regional domain. The inclusion of the product URL is not necessary for price-history storage (the `productId` field alone would suffice as a key), but it enables the remote server to reconstruct a timestamped browsing history of every AliExpress product page the user visited while logged in. This data, tied to the persistent install UUID, constitutes a detailed purchase-intent and browsing profile.

return {  productId: i,  productName: n,  price: c.price,  shippingCost: h,  currency: p,  domain: t.hostname,  language: S,  variant: d,  url: `${t.origin}${t.pathname}`}

The capture function explicitly gates data collection on the user being logged in to AliExpress (`Lt.isLoggedIn(document)`). While this could reduce noise from anonymous visitors, targeting only authenticated sessions means the exfiltrated observations are implicitly correlated with real user accounts. A price-tracking tool has no technical need to verify login state before recording prices; this check specifically maximises the value of the collected data by filtering it to active, authenticated shoppers.

async function ls() {    if (!Lt) {      console.log("[Anubis] no adapter for host", location.hostname);      return    }    let e = new URL(location.href);    if (!Lt.isProductPage(e)) {      console.log("[Anubis] not a product page, skipping", e.pathname);      return    }    if (!Lt.isLoggedIn(document)) {      console.log("[Anubis] user not logged in; skipping capture");      return    }    let t = Lt.extract(document, e);