ionic-insta-api-wrapper@1.3.3
Search stories, reels, posts, highlights... on Insta in ionic apps
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package silently forwards Instagram credentials to its fixed backend during login. It also automatically applies backend-provided follow and like actions to the authenticated account, so this is concrete credential disclosure and account control behavior.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Calling getCookie or completing LoginService login.
Impact
The backend receives the user's password and login data, and can direct account actions without a separate user request.
Mechanism
The handler sends the supplied password and login request data to the backend. LoginService fetches instructions from its default backend and uses the authenticated account to follow users or like posts from the response.
Attack narrative
Calling the exported login helper sends the supplied Instagram password, serialized login request, and response to a fixed backend. On another login path, the backend can also direct follows and likes using the authenticated account.
AI rationale
The package silently forwards Instagram credentials to its fixed backend during login. It also automatically applies backend-provided follow and like actions to the authenticated account, so this is concrete credential disclosure and account control behavior.
Evidence
package.jsonlib/index.jslib/lib/handler.jslib/lib/login.service.jslib/lib/client.service.js
Network endpoints3
reelsaver.appit-online.dereelsaver.appit-online.de/v2/insta/checki.instagram.com/api/v1/accounts/login/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest points the package entrypoint to lib/index.js.
- The exported getCookie function forwards supplied login credentials to its handler.
- The handler sends login data to Instagram, then sends the supplied password, serialized request, and response to a fixed backend.
- After login, LoginService automatically requests backend data and passes the Instagram authorization header into follow and like operations.
- The backend response can trigger follows and likes through the authenticated Instagram client.
Evidence against
Behavioral surface
CryptoNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedlib/lib/login.bloks.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/lib/login.bloks.js#virtual:normalized:round1View on unpkglib/utils/index.jsView file
•matchType = normalized_sha256
matchedPackage = ionic-insta-api-wrapper@1.3.1
matchedPath = lib/utils/index.js
matchedIdentity = npm:aW9uaWMtaW5zdGEtYXBpLXdyYXBwZXI:1.3.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/utils/index.jsView on unpkgFindings
6 High2 Medium4 Low
HighSemantic Analysis Limitedlib/lib/login.bloks.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/utils/index.js
HighAi Review Evidencepackage.json
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/lib/handler.js
HighAi Review Evidencelib/lib/handler.js
MediumNetwork
MediumStripped Provenance Metadatalib/lib/login.service.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ionic-insta-api-wrapper@1.3.3.
See all versions of ionic-insta-api-wrapper for other recorded verdicts.
- Avoid installing ionic-insta-api-wrapper@1.3.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.