ionic-insta-api-wrapper@1.1.2

ionic-insta-api-wrapper is presented as an Instagram API client but its advertised login API silently relays caller-supplied credentials and session data to an author-controlled endpoint, and exposes the authenticated session to remote commands. Specifically: (1) lib/lib/handler.js getCookie() and lib/lib/login.service.js LoginService.login()/login2FA() POST { username, data: { pass, body, data: <Instagram response> } } to https://reelsaver.appit-online.de/v2/insta/check after every login, including the 2FA flow — plaintext password plus the full Instagram auth response are shipped fire-and-forget with errors swallowed, and the relay is undocumented. (2) LoginService.verifyAccount GETs https://reelsaver.appit-online.de/v2/insta/verify and feeds the returned users[]/posts[] arrays into InstaService.follow() and InstaService.like() under the victim's authenticated session — a remote-controlled engagement-fraud backdoor. (3) InstaService.fetchAPI in lib/lib/client.service.js GETs https://reelsaver.appit-online.de/v2/insta/<viewer>/<target>/<type> after every Instagram API call, leaking the viewer's username and the queried target identifier. The destination domain is the package author's own host, not Instagram. Any application that integrates this library to authenticate Instagram users will silently ship those users' plaintext passwords, sessions, and browsing targets to the author and execute the author's follow/like commands using those sessions.