What our analysis found

DSers-Dropshipping+AliExpress Importer, used by 400,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites and can inject scripts into pages. It comes from a trusted publisher and was last updated in October 2026.

The extension is a legitimate dropshipping helper that imports products from to DSers for It uses broad permissions (tabs, scripting, declarativeNetRequest, <all_urls>) necessarily for its multi‑site automation, coupon injection, and order tracking. All outbound communication goes to the publisher’s own domain (), matching the privacy policy. No exfiltration to third parties, no obfuscation beyond standard webpack minification, and no suspicious remote code loading were found in the reviewed source files. The ML model and risk-engine over‑weight the permission set and common helper patterns (XMLHttpRequest, postMessage, innerHTML) that are intrinsic to the extension’s stated functionality.