registry / Credential exfiltration / insta-api-wrapper
insta-api-wrapper
Anonymous Stories, Search & Download reels, posts, highlights... on Insta
This report shows the evidence for insta-api-wrapper@1.2.1. 3 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource confirms unconsented forwarding of caller-supplied Instagram passwords to a fixed external recipient and automatic backend-selected account actions after login. These are concrete attack behaviors, so the package should be blocked.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A caller invokes getCookie or completes LoginService login or two-factor login.
Impact
The external service receives the supplied password and login data; the account can also be made to follow users or like posts without a separate caller request for those actions.
Mechanism
The handler forwards login data to reelsaver.appit-online.de, while LoginService automatically requests backend instructions and applies returned user and post targets using Instagram follow and like requests.
Attack narrative
Calling the exported login helper with a username and password causes the handler to send those credentials to Instagram and then to a fixed external service. Separately, successful LoginService login automatically fetches instructions from that service and uses the authenticated Instagram account to follow selected users and like selected posts.
AI rationale
Source confirms unconsented forwarding of caller-supplied Instagram passwords to a fixed external recipient and automatic backend-selected account actions after login. These are concrete attack behaviors, so the package should be blocked.
Evidence
lib/index.jslib/lib/handler.jslib/lib/login.service.jslib/lib/client.service.js
Network endpoints4
i.instagram.com/api/v1/accounts/login/reelsaver.appit-online.de/v2/insta/checkreelsaver.appit-online.de/v2/insta/verifyi.instagram.com/api/v1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The public getCookie function forwards the supplied username and password to the login handler.
- After sending the supplied password to Instagram, the handler sends the username and password to a fixed external endpoint.
- After login, LoginService automatically requests verification from its default external backend and passes the returned data into account actions.
- The backend response selects users to follow and posts to like through the authenticated Instagram client.
Evidence against
Behavioral surface
CryptoNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedlib/utils/index.jsView file
•matchType = normalized_sha256
matchedPackage = insta-api-wrapper@1.1.4
matchedPath = lib/utils/index.js
matchedIdentity = npm:aW5zdGEtYXBpLXdyYXBwZXI:1.1.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/utils/index.jsView on unpkglib/index.jsView file
1import { getCookies } from './lib/handler.js';
export function getCookie(username, password, withLoginData = false) {
return getCookies(username, password, withLoginData);
}
ex
High
Ai Review Evidence
The public getCookie function forwards the supplied username and password to the login handler.
lib/index.jsView on unpkg · L1lib/lib/handler.jsView file
Findings
7 High1 Medium4 Low
HighKnown Malware Source Similaritylib/utils/index.js
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to insta-api-wrapper@1.2.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing insta-api-wrapper@1.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.