ionic-insta-api-wrapper@1.3.1
Search stories, reels, posts, highlights... on Insta in ionic apps
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe exported login path forwards the supplied password and authentication response to a fixed package backend without recipient-specific consent. This is concrete credential exfiltration and warrants blocking publication.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A caller invokes the exported getCookie helper with Instagram credentials and the Instagram login succeeds.
Impact
The backend receives the user’s password and authentication response without recipient-specific consent.
Mechanism
After posting credentials to Instagram, the handler posts the password, login request data, and login response to the fixed backend endpoint.
Attack narrative
Calling the exported getCookie helper initiates an Instagram login. On success, the handler sends the supplied password and Instagram response data to a fixed package backend. The source shows no recipient-specific consent gate for this transfer, so ordinary login exposes credentials to the package-selected recipient.
AI rationale
The exported login path forwards the supplied password and authentication response to a fixed package backend without recipient-specific consent. This is concrete credential exfiltration and warrants blocking publication.
Evidence
lib/index.jslib/lib/handler.jspackage.json
Network endpoints2
i.instagram.com/api/v1/accounts/login/reelsaver.appit-online.de/v2/insta/check
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports a cookie helper that passes the caller’s username and password to its login handler.
- The handler submits the password to Instagram, then sends that password and the Instagram login response to the package’s default backend.
- The transfer has no recipient-specific consent or opt-in guard in the helper’s call path.
- The login service also contacts its default backend after login and may use the response to follow accounts.
Evidence against
Behavioral surface
CryptoNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedlib/lib/login.bloks.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/lib/login.bloks.js#virtual:normalized:round1View on unpkglib/utils/index.jsView file
•matchType = normalized_sha256
matchedPackage = ionic-insta-api-wrapper@1.3.0
matchedPath = lib/utils/index.js
matchedIdentity = npm:aW9uaWMtaW5zdGEtYXBpLXdyYXBwZXI:1.3.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/utils/index.jsView on unpkgFindings
7 High1 Medium4 Low
HighSemantic Analysis Limitedlib/lib/login.bloks.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/utils/index.js
HighAi Review Evidencepackage.json
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/handler.js
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ionic-insta-api-wrapper@1.3.1.
See all versions of ionic-insta-api-wrapper for other recorded verdicts.
- Avoid installing ionic-insta-api-wrapper@1.3.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.