injects obfuscated javascript into every page which contains code to create an iframe to 'https://s.click.aliexpress.com/e/_Bfgg74HL' on any url containing 'shoppingcart.aliexpress.' in the hostname:

also found another review w another user claiming the same thing w the dev saying he 'fixed' it.. that was 2 months ago, and it still does it ...

nowhere in the about page is there any mention of this 'feature' ...

de-obfuscated js code : https://pastebin.com/8Eks2TcF