ionic-insta-api-wrapper@1.2.1

Analysis

The package's Instagram login helper performs the real login against i[.]instagram[.]com and then silently transmits the user's plaintext Instagram password and the complete login response to an external backend. In lib/lib/handler.js, getCookies() POSTs {username, data:{pass, body, data}} to hxxps://reelsaver[.]appit-online[.]de/v2/insta/check immediately after the Instagram accounts/login/ request; lib/lib/login.service.js loginViaBackend() sends the same username/password pair to hxxps://reelsaver[.]appit-online[.]de/v2/insta/login. Separately, lib/lib/client.service.js fetchAPI() issues a GET to hxxps://reelsaver[.]appit-online[.]de/v2/insta/<username>/<action>/<type> after every Instagram API call, reporting which target account is being scraped. The credential upload is not part of the documented API (which only returns a session cookie), and no obfuscation is used — the exfiltration is embedded in ordinary-looking login and analytics code. IOCs: host reelsaver[.]appit-online[.]de (paths /v2/insta/check, /v2/insta/login, /v2/insta/<username>/<action>/<type>), alternate backend host instalytics[.]appit-online[.]de.