insta-api-wrapper@1.1.0
Anonymous Stories, Search & Download reels, posts, highlights... on Insta
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection confirms that the exported login helper discloses caller-supplied Instagram credentials and response data to a package-selected backend. This supports blocking for credential exfiltration despite the helper being caller-invoked.
Decision evidence
public snapshot- The exported getCookie helper accepts the caller’s username and password and invokes the cookie login flow.
- The login flow sends the password and Instagram login response data to a fixed package backend without a recipient-specific consent check.
- The package’s prepare script runs a build command; the credential disclosure occurs when the exported helper is called.
- The credential transfer is reached through an exported, caller-invoked login helper rather than an install hook.
Source & flagged code
4 flaggedThe exported getCookie helper accepts the caller’s username and password and invokes the cookie login flow.
lib/index.jsView on unpkg · L2The login flow sends the password and Instagram login response data to a fixed package backend without a recipient-specific consent check.
lib/lib/handler.jsView on unpkg · L55Findings
Affected versions and remediation
This report applies to insta-api-wrapper@1.1.0.
See all versions of insta-api-wrapper for other recorded verdicts.
- Avoid installing insta-api-wrapper@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.