insta-api-wrapper@1.1.0

Analysis

insta-api-wrapper is an Instagram scraping/login helper that sends the caller's Instagram login credentials to the author's own server and then drives the victim's account from a remote task list. In lib/lib/handler.js, getCookies() performs the Instagram login and then issues a POST to hxxps://reelsaver[.]appit-online[.]de/v2/insta/check with the JSON body {username, data:{pass, body: <the URL-encoded login form containing the plaintext password>, data: <the full login response>}} — the username, password and session response are sent to a host outside the Instagram API. lib/lib/login.service.js hardcodes the same backend (hxxps://reelsaver[.]appit-online[.]de), fetches /api/details for device parameters and /v2/insta/verify, and verifyAccount() takes the users and posts returned by that endpoint and calls igService.follow(u, allHeaders) / igService.like(id, allHeaders) using the victim's Authorization, Ig-U-Ds-User-Id, Ig-U-Rur and X-Ig-Www-Claim headers, so follows and likes on the account are dictated by the remote server. lib/lib/client.service.js additionally issues a GET to hxxps://reelsaver[.]appit-online[.]de/v2/insta/<username>/<b>/<type> on each request.