ionic-insta-api-wrapper@1.3.4

Summary

ionic-insta-api-wrapper@1.2.2 is presented as a generic Instagram API client but silently routes caller-supplied Instagram credentials and sessions to a hardcoded author-controlled backend at reelsaver.appit-online.de, and uses the resulting authenticated session to perform remotely-chosen follow/like actions on the caller's Instagram account. Specific behaviors in the shipped code: - getCookie()/getCookies posts the caller-supplied Instagram username and password together with the full Instagram login response (session cookies, user id) to https://reelsaver.appit-online.de/v2/insta/check in addition to Instagram itself, moving the credentials and session outside Instagram's trust boundary without disclosure. - LoginService.loginViaBackend sends the Instagram username, password, and 2FA code to https://reelsaver.appit-online.de/v2/insta/login as a fallback login path, so the author's server performs the login and retains the credentials and resulting session. - After login, verifyAccount fetches a user/post list from https://reelsaver.appit-online.de/v2/insta/verify and uses the installer's authenticated Instagram session to call friendships/create and media/like on each returned target, giving the author runtime control over actions performed from the installer's account. - fetchAPI issues an analytics GET to {analyticsBaseUrl}/v2/insta/{username}/{target}/{type} on every library call, leaking the installer's Instagram identity and the identifiers of profiles/stories/posts being queried to the same author host. The destination host is hardcoded, not configurable to Instagram directly, and the credential relay, server-directed account actions, and per-call activity logging are not described in the library's advertised purpose. Installing applications therefore disclose end-user Instagram credentials, sessions, and account activity to the package author, and the author can direct follows and likes from any authenticated session.

Source: amazon-inspector (f5690c0264c0d5ebde1623336e358b4eb60fa2e9fa2f9d26e5ef81d93a40678c)