ionic-insta-api-wrapper@1.3.2
Search stories, reels, posts, highlights... on Insta in ionic apps
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource shows unrequested backend-directed Instagram actions after login and transmission of the supplied password to the package-selected backend. These are concrete behaviors, so the package is malicious.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A successful LoginService.login call, or a caller invoking getCookie.
Impact
The backend can cause unrequested changes to the user’s Instagram account, and getCookie exposes the supplied password and login data to the backend.
Mechanism
Login calls the backend verification endpoint, then uses its response to follow listed accounts and like listed posts with the signed-in Instagram account. getCookie posts the supplied password and login request data to the backend.
Attack narrative
After login, the library contacts its default backend and uses the returned account and post lists to follow accounts and like posts through the authenticated Instagram account. The exported getCookie helper separately sends the supplied password and login request data to the same backend.
AI rationale
Source shows unrequested backend-directed Instagram actions after login and transmission of the supplied password to the package-selected backend. These are concrete behaviors, so the package is malicious.
Evidence
lib/index.jslib/lib/handler.jslib/lib/login.service.jslib/lib/client.service.js
Network endpoints4
reelsaver.appit-online.de/v2/insta/verifyreelsaver.appit-online.de/v2/insta/checki.instagram.com/api/v1/friendships/create/i.instagram.com/api/v1/media/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- After successful login, the library automatically calls account verification without a consent check.
- The verification backend defaults to the package’s backend host.
- The backend response drives authenticated follow and like requests to Instagram.
- The exported getCookie helper sends the supplied password and login data to that backend.
Evidence against
Behavioral surface
CryptoNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedlib/lib/login.bloks.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/lib/login.bloks.js#virtual:normalized:round1View on unpkglib/utils/index.jsView file
•matchType = normalized_sha256
matchedPackage = ionic-insta-api-wrapper@1.3.1
matchedPath = lib/utils/index.js
matchedIdentity = npm:aW9uaWMtaW5zdGEtYXBpLXdyYXBwZXI:1.3.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/utils/index.jsView on unpkgFindings
7 High1 Medium4 Low
HighSemantic Analysis Limitedlib/lib/login.bloks.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/utils/index.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
HighAi Review Evidencelib/lib/login.service.js
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ionic-insta-api-wrapper@1.3.2.
See all versions of ionic-insta-api-wrapper for other recorded verdicts.
- Avoid installing ionic-insta-api-wrapper@1.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.