ionic-insta-api-wrapper@1.2.2
Search stories, reels, posts, highlights... on Insta in ionic apps
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe source confirms that ordinary Instagram login credentials are sent to a fixed publisher-selected backend, including on the exported getCookie path. This is concrete credential disclosure and supports blocking publication.
Static reason
No blocking static signals were detected.
Trigger
A consumer invokes getCookie, or invokes LoginService.login and its direct login attempt fails.
Impact
The publisher-selected recipient receives the user's Instagram password and login data without recipient-specific consent.
Mechanism
After authenticating to Instagram, getCookie posts the supplied password and serialized login data to reelsaver.appit-online.de. The fallback login route posts the password to the same default backend.
Attack narrative
When consumers use the exported login helper, it first sends credentials to Instagram and then sends the password and serialized request and response to the package's fixed reelsaver.appit-online.de endpoint. The login service has a second path that sends the password to that default backend when direct Instagram login fails. The source shows no recipient-specific consent gate for either transfer.
AI rationale
The source confirms that ordinary Instagram login credentials are sent to a fixed publisher-selected backend, including on the exported getCookie path. This is concrete credential disclosure and supports blocking publication.
Evidence
lib/index.jslib/lib/handler.jslib/lib/login.service.js
Network endpoints3
i.instagram.com/api/v1/accounts/login/reelsaver.appit-online.de/v2/insta/checkreelsaver.appit-online.de/v2/insta/login
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports getCookie through its main entrypoint.
- getCookie sends the supplied username and password to Instagram, then posts the password and serialized login request and response to a fixed reelsaver.appit-online.de endpoint.
- LoginService defaults its backend to reelsaver.appit-online.de and sends the supplied password there when its direct Instagram login attempt fails.
Evidence against
- The initial getCookie login request and the Bloks login attempt target Instagram.
Behavioral surface
CryptoNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedlib/lib/login.bloks.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/lib/login.bloks.js#virtual:normalized:round1View on unpkgpackage.jsonView file
5"main": "lib/index.js",
"types": "lib/index.d.ts",
"scripts": {
"test": "jest --config jestconfig.json",
"
High
Ai Review Evidence
The package exports getCookie through its main entrypoint.
package.jsonView on unpkg · L5lib/index.jsView file
Findings
7 High1 Medium4 Low
HighSemantic Analysis Limitedlib/lib/login.bloks.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ionic-insta-api-wrapper@1.2.2.
See all versions of ionic-insta-api-wrapper for other recorded verdicts.
- Avoid installing ionic-insta-api-wrapper@1.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.