insta-api-wrapper@1.1.4
Anonymous Stories, Search & Download reels, posts, highlights... on Insta
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection confirms unconsented forwarding of supplied Instagram credentials to a package-selected external recipient. The login flow also performs authenticated account actions based on that service's response, so this is malicious behavior warranting a publish block.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Calling the exported getCookie helper, or completing a successful LoginService login.
Impact
The external service receives the supplied password and login data; the account may also follow users or like posts selected by the service.
Mechanism
The helper posts credentials and the Instagram login request and response to reelsaver.appit-online.de. The separate login flow automatically checks that service and uses returned user and post lists for authenticated account actions.
Attack narrative
Calling getCookie sends the caller's Instagram password, login request body, and response to a fixed external service. After a separate login flow succeeds, the same service can return user and post lists that cause authenticated follows and likes without a caller-selected target list.
AI rationale
Source inspection confirms unconsented forwarding of supplied Instagram credentials to a package-selected external recipient. The login flow also performs authenticated account actions based on that service's response, so this is malicious behavior warranting a publish block.
Evidence
package.jsonlib/index.jslib/lib/handler.jslib/lib/login.service.jslib/lib/client.service.js
Network endpoints3
i.instagram.com/api/v1/accounts/login/reelsaver.appit-online.de/v2/insta/checkreelsaver.appit-online.de/v2/insta/verify
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports getCookie with username and password arguments through its main entrypoint.
- The login helper sends the supplied username, password, login request body, and Instagram response to a fixed external service without a consent check.
- The separate login service defaults to that same external service and automatically runs account verification after login.
- The verification response can trigger authenticated follows and likes on the logged-in account.
Evidence against
- The flagged utility file only converts Instagram shortcodes and media IDs; it does not explain away the credential transfer in the login helper.
Behavioral surface
CryptoNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedlib/utils/index.jsView file
•matchType = normalized_sha256
matchedPackage = insta-api-wrapper@1.1.0
matchedPath = lib/utils/index.js
matchedIdentity = npm:aW5zdGEtYXBpLXdyYXBwZXI:1.1.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/utils/index.jsView on unpkgpackage.jsonView file
5"main": "lib/index.js",
"type": "module",
"types": "lib/index.d.ts",
"scripts": {
"test": "jest --config jestconfig.js
High
Ai Review Evidence
The package exports getCookie with username and password arguments through its main entrypoint.
package.jsonView on unpkg · L5lib/index.jsView file
Findings
7 High1 Medium4 Low
HighKnown Malware Source Similaritylib/utils/index.js
HighAi Review Evidencepackage.json
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to insta-api-wrapper@1.1.4.
See all versions of insta-api-wrapper for other recorded verdicts.
- Avoid installing insta-api-wrapper@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.