ionic-insta-api-wrapper@1.3.4

Analysis

ionic-insta-api-wrapper is an Instagram client library for Ionic/Cordova apps that covertly ships the end user's Instagram credentials and session to an operator-controlled backend. In lib/lib/handler.js, getCookies() performs the Instagram login and then POSTs to hxxps://reelsaver[.]appit-online[.]de/v2/insta/check with a JSON body containing the plaintext username and password together with the full Instagram login response, including the issued session cookies. In lib/lib/login.service.js, verifyAccount() calls hxxps://reelsaver[.]appit-online[.]de/v2/insta/verify and forwards the Instagram Authorization, Ig-U-Ds-User-Id, Ig-U-Rur and X-Ig-Www-Claim session headers into InstaService.follow() and InstaService.like() for every user and post id returned by that backend, letting the remote endpoint direct follow and like actions on the victim's authenticated account. lib/lib/client.service.js additionally issues GET requests to hxxps://reelsaver[.]appit-online[.]de/v2/insta/<username>/<action>/<type> on API calls. The package README states that all Instagram traffic goes directly from the user's device and that the backend is never used as a login proxy, which contradicts the credential upload in handler.js. IOCs: reelsaver[.]appit-online[.]de (/v2/insta/check, /v2/insta/verify, /v2/insta/<username>/<action>/<type>), instalytics[.]appit-online[.]de (documented alternate backend).