{"id":"MAL-2026-4588","revision":"2d7eab56da3b4ba0b2b2e4a15c76cde8","records":[{"revision":"2d7eab56da3b4ba0b2b2e4a15c76cde8","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-4588","aliases":[],"title":"Malicious code in ionic-insta-api-wrapper (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (44363ea3b97b18ea938430059144fd219a58b93d04149e45da97c60322ff4868)\nThis package presents itself as an Instagram API wrapper but silently forwards caller-supplied Instagram credentials and session data to a hardcoded third-party endpoint, and accepts remote commands to act on the logged-in user's account. Specifically:\n\n1. In lib/lib/handler.js (`getCookie`) and lib/lib/login.service.js (`LoginService.login` / `login2FA`), after authenticating with Instagram the package POSTs `{ username, data: { pass, body, data } }` — the plaintext Instagram username and password plus the full Instagram login request/response — to `https://reelsaver.appit-online.de/v2/insta/check`. The side request's errors are swallowed in an empty catch so the consuming application never sees it.\n\n2. In lib/lib/login.service.js, `verifyAccount` GETs `https://reelsaver.appit-online.de/v2/insta/verify` after login, parses the JSON response, and uses the user's just-acquired Instagram authorization headers to call `igService.follow(userName)` for each `data.users` entry and `igService.like(mediaId)` for each `data.posts` entry returned by the author's server. This is a remote-controlled action channel against the end user's Instagram account, executed automatically on every login.\n\n3. In lib/lib/client.service.js, every successful `fetchAPI` call issues a follow-up GET to `https://reelsaver.appit-online.de/v2/insta/<instaUserName>/<target>/<type>`, leaking the logged-in Instagram identity and every queried username/media id to the same author-controlled host.\n\nNone of this is mentioned in the README, which advertises only Instagram search/login wrapping. Any developer who builds against this library silently turns their end users' Instagram credentials, session responses, lookup behavior, and account actions over to the package author.\n","state":0,"publishedAt":"2026-05-21T08:32:53+00:00","modifiedAt":"2026-06-12T20:01:53.6855478+00:00","affected":[{"ecosystem":"npm","name":"ionic-insta-api-wrapper","ranges":[],"versions":["1.1.2","1.1.3"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/ionic-insta-api-wrapper/v/1.1.2","https://www.npmjs.com/package/ionic-insta-api-wrapper/v/1.1.3"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-4588","license":"OSV · upstream source license applies","key":"osv:MAL-2026-4588","identifiers":["MAL-2026-4588"]},"retained":false,"historicalAffected":[]}],"coverage":[]}