{"id":"MAL-2026-4588","summary":"Malicious code in ionic-insta-api-wrapper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (44363ea3b97b18ea938430059144fd219a58b93d04149e45da97c60322ff4868)\nThis package presents itself as an Instagram API wrapper but silently forwards caller-supplied Instagram credentials and session data to a hardcoded third-party endpoint, and accepts remote commands to act on the logged-in user's account. Specifically:\n\n1. In lib/lib/handler.js (`getCookie`) and lib/lib/login.service.js (`LoginService.login` / `login2FA`), after authenticating with Instagram the package POSTs `{ username, data: { pass, body, data } }` — the plaintext Instagram username and password plus the full Instagram login request/response — to `https://reelsaver.appit-online.de/v2/insta/check`. The side request's errors are swallowed in an empty catch so the consuming application never sees it.\n\n2. In lib/lib/login.service.js, `verifyAccount` GETs `https://reelsaver.appit-online.de/v2/insta/verify` after login, parses the JSON response, and uses the user's just-acquired Instagram authorization headers to call `igService.follow(userName)` for each `data.users` entry and `igService.like(mediaId)` for each `data.posts` entry returned by the author's server. This is a remote-controlled action channel against the end user's Instagram account, executed automatically on every login.\n\n3. In lib/lib/client.service.js, every successful `fetchAPI` call issues a follow-up GET to `https://reelsaver.appit-online.de/v2/insta/\u003cinstaUserName\u003e/\u003ctarget\u003e/\u003ctype\u003e`, leaking the logged-in Instagram identity and every queried username/media id to the same author-controlled host.\n\nNone of this is mentioned in the README, which advertises only Instagram search/login wrapping. Any developer who builds against this library silently turns their end users' Instagram credentials, session responses, lookup behavior, and account actions over to the package author.\n","modified":"2026-06-12T20:01:53.685547815Z","published":"2026-05-21T08:32:53Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"02b21f843420dc38a87320830c9f9bd48d72a2938774100b1ee08a2db708abbc","import_time":"2026-05-26T05:51:18.217487516Z","id":"IN-MAL-2026-003782","modified_time":"2026-05-21T08:32:53Z","versions":["1.1.2"]},{"versions":["1.1.3"],"source":"amazon-inspector","sha256":"44363ea3b97b18ea938430059144fd219a58b93d04149e45da97c60322ff4868","import_time":"2026-06-12T19:44:11.202353391Z","id":"IN-MAL-2026-006128","modified_time":"2026-06-12T19:09:36Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ionic-insta-api-wrapper/v/1.1.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ionic-insta-api-wrapper/v/1.1.3"}],"affected":[{"package":{"name":"ionic-insta-api-wrapper","ecosystem":"npm","purl":"pkg:npm/ionic-insta-api-wrapper"},"versions":["1.1.2","1.1.3"],"database_specific":{"indicators":{"package_integrity":[{"filename":"ionic-insta-api-wrapper-1.1.2.tgz","hashes":{"sha1":"afd3d9d274856ffebbc803db0663f4c2ae3970d1","sha512_sri":"sha512-8RxpZYBGWc5M3t3dMSpFDWGqyzZzZvyu5UptvuuLdikNKddOtgibvC9TDCTLnaaS/3GvNQPAok7o9Ej0XHTwfQ=="}}],"evidence_files":[{"path":"lib/lib/handler.js","sha256":"2569999371e8a0862105562de826d5baaed348187ab93ff0b9457bffa97ab1f6","tlsh":"07610ea574fa313a155125c24617140238a4a20331caeca8befd97365fc9c0fca796df"},{"tlsh":"9332635a66f314200913a4d98f2b5001a139f40b3594dc69bbfc47596f8a82c97babff","path":"lib/lib/login.service.js","sha256":"d1217df1f0a796fef8c1e607e5330507de2ebce6a13a5bf507601b543f4b180a"},{"path":"lib/lib/client.service.js","sha256":"252f4152d7f179b34592a47a1641d9ceda5101c6a6a57174a02c0240ed1baf06","tlsh":"bca2a66591ff242b0513a498db2b5424b225e50732d4ec18befd47182f89618cbb77fb"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ionic-insta-api-wrapper/MAL-2026-4588.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}