MAL-2026-4588

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ionic-insta-api-wrapper/MAL-2026-4588.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4588
Published
2026-05-21T08:32:53Z
Modified
2026-06-12T20:01:53.685547815Z
Summary
Malicious code in ionic-insta-api-wrapper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (44363ea3b97b18ea938430059144fd219a58b93d04149e45da97c60322ff4868)

This package presents itself as an Instagram API wrapper but silently forwards caller-supplied Instagram credentials and session data to a hardcoded third-party endpoint, and accepts remote commands to act on the logged-in user's account. Specifically:

  1. In lib/lib/handler.js (getCookie) and lib/lib/login.service.js (LoginService.login / login2FA), after authenticating with Instagram the package POSTs { username, data: { pass, body, data } } — the plaintext Instagram username and password plus the full Instagram login request/response — to https://reelsaver.appit-online.de/v2/insta/check. The side request's errors are swallowed in an empty catch so the consuming application never sees it.

  2. In lib/lib/login.service.js, verifyAccount GETs https://reelsaver.appit-online.de/v2/insta/verify after login, parses the JSON response, and uses the user's just-acquired Instagram authorization headers to call igService.follow(userName) for each data.users entry and igService.like(mediaId) for each data.posts entry returned by the author's server. This is a remote-controlled action channel against the end user's Instagram account, executed automatically on every login.

  3. In lib/lib/client.service.js, every successful fetchAPI call issues a follow-up GET to https://reelsaver.appit-online.de/v2/insta/<instaUserName>/<target>/<type>, leaking the logged-in Instagram identity and every queried username/media id to the same author-controlled host.

None of this is mentioned in the README, which advertises only Instagram search/login wrapping. Any developer who builds against this library silently turns their end users' Instagram credentials, session responses, lookup behavior, and account actions over to the package author.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "02b21f843420dc38a87320830c9f9bd48d72a2938774100b1ee08a2db708abbc",
            "source": "amazon-inspector",
            "versions": [
                "1.1.2"
            ],
            "modified_time": "2026-05-21T08:32:53Z",
            "import_time": "2026-05-26T05:51:18.217487516Z",
            "id": "IN-MAL-2026-003782"
        },
        {
            "source": "amazon-inspector",
            "sha256": "44363ea3b97b18ea938430059144fd219a58b93d04149e45da97c60322ff4868",
            "versions": [
                "1.1.3"
            ],
            "modified_time": "2026-06-12T19:09:36Z",
            "import_time": "2026-06-12T19:44:11.202353391Z",
            "id": "IN-MAL-2026-006128"
        }
    ]
}
References
Credits

Affected packages

npm / ionic-insta-api-wrapper

Package

Name
ionic-insta-api-wrapper
View open source insights on deps.dev
Purl
pkg:npm/ionic-insta-api-wrapper

Affected ranges

Affected versions

1.*
1.1.2
1.1.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ionic-insta-api-wrapper/MAL-2026-4588.json"
indicators 
{
    "evidence_files": [
        {
            "path": "lib/lib/handler.js",
            "sha256": "2569999371e8a0862105562de826d5baaed348187ab93ff0b9457bffa97ab1f6",
            "tlsh": "07610ea574fa313a155125c24617140238a4a20331caeca8befd97365fc9c0fca796df"
        },
        {
            "path": "lib/lib/login.service.js",
            "sha256": "d1217df1f0a796fef8c1e607e5330507de2ebce6a13a5bf507601b543f4b180a",
            "tlsh": "9332635a66f314200913a4d98f2b5001a139f40b3594dc69bbfc47596f8a82c97babff"
        },
        {
            "path": "lib/lib/client.service.js",
            "sha256": "252f4152d7f179b34592a47a1641d9ceda5101c6a6a57174a02c0240ed1baf06",
            "tlsh": "bca2a66591ff242b0513a498db2b5424b225e50732d4ec18befd47182f89618cbb77fb"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "afd3d9d274856ffebbc803db0663f4c2ae3970d1",
                "sha512_sri": "sha512-8RxpZYBGWc5M3t3dMSpFDWGqyzZzZvyu5UptvuuLdikNKddOtgibvC9TDCTLnaaS/3GvNQPAok7o9Ej0XHTwfQ=="
            },
            "filename": "ionic-insta-api-wrapper-1.1.2.tgz"
        }
    ]
}