Security Alert: Malware Risk Confirmed

This extension is flagged as malware and the latest analysis also reports severe findings. Remove it immediately if installed.Extension: FastSave

CRITICAL RISKStill available - exercise caution

FastSave

ID: pnlphjjfielecalmmjjdhjjninkbjdod

Supported Languages

🇧🇷Brazilian Portuguese

🇬🇧British English

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇺Russian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

Extension Info & Metadata

Status

Active

Version

3.8.8

Size

0.68 MB

Rating

3.4/5

Reviews

344

Users

100,000

Type

Extension

Updated

Apr 16, 2026

Publisher Contextual Analysis

Trusted

Author: spector.netView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

100,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Repost Instagram stories, save video, photo and Reels. Browse Instagram site like a mobile app.

Instagram video downloader to save videos you love, and watch whenever you want. It’s easy to save and organize all the content that catches your eye. This tool is fast, letting you download any image or video from your feed. Instagram reels download is perfect for saving those quick, fun videos you want to watch offline. With Instagram downloader, you can grab any content you like and keep it handy on your device. Download stories, posts, and even longer videos from IGTV in seconds. This tool makes it simple to save anything inspiring or fun. With Instagram story download, you’ll never lose access to stories you enjoy. Don’t let your favorite moments slip away. This downloader saves everything, so you can enjoy it offline anytime. Use Instagram reels download to save creative videos from friends or creators, and keep them forever. Save from Instagram easily, so you can always have what you love. Just one tap, and any video or story is saved straight to your gallery. Now you can have full-quality images and videos at your fingertips. With Instagram video download, you can capture all the best moments worth keeping. The tool makes saving Instagram content fast and easy. IG downloads are great for people who like collecting and sharing memories. Keep posts from your favorite friends, influencers, or brands. With Instagram, you’ll never have to worry about losing a story or video you like. Download what matters most, and organize it in your own way. Instagram reels download lets you keep fun, quick videos right on your device. It’s the best way to save those trending reels or funny moments you find. Watch your favorite reels whenever you want, even offline. With Instagram, you can save all the content that inspires or entertains you. Found a story you love and don’t want it to disappear? Instagram story download lets you keep stories forever, so you can view them even after they’re gone from the app. All your downloads are saved to your gallery, making them easy to find. Use Instagram to save your favorite memories, inspiration, or fun moments, all in one place. Our extension is in a partnership with Admitad (https://admitad.com/). We use this service only for link affilication. We DO NOT save any of your search queries nor are we making any rewards from your search queries. We can receive a reward for sales that happen after users click on the affiliate links.

User Growth

Showing data from Jan 01, 2022 to Mar 02, 2023

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 85 ratings+23 (37%)

Average Rating

Current: 4.76 / 5.0+4.76

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High13

Medium8

Low0

Versions scanned

Showing 3 of 19 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.8.8 Code review	8
3.8.3 Code review	8
3.8.1 Code review	10

Extension Version	Code Review Findings
3.8.8	8
3.8.3	8
3.8.1	10

Files with findings

7 distinct paths — top paths by unique finding count:

js/serviceWorker.js13
js/instaBg.js5
js/inject.js3
manifest.json2
js/contentScript.js1
js/main.js1
js/storyIn.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/serviceWorker.js (line 5887)	The extension harvests ALL cookies for *.instagram.com via chrome.cookies.getAll, explicitly requiring the authentication tokens `sessionid` and `ds_user_id` to be present. These are Instagram's session cookies that f…	3.8.3
2	Credential Theft	critical	js/serviceWorker.js (line 742)	Uses webRequest.onBeforeSendHeaders to intercept traffic to Instagram's `accounts/get_encrypted_credentials` (login/password) endpoint and other authenticated APIs, scraping the anti-CSRF tokens `x-ig-www-claim`, `x-a…	3.8.3
3	Credential Theft	critical	js/serviceWorker.js (line 4986)	The service worker harvests ALL Instagram cookies via chrome.cookies.getAll, specifically validating that sessionid and ds_user_id are present — these are Instagram's full account session credentials (session cookie +…	3.8.1
4	Credential Theft	critical	js/serviceWorker.js (line 5043)	The background exposes three message handlers (getCookies, getXHeaders, getCsrftoken) that hand the user's Instagram session cookies and captured auth headers back to any content script that asks. Any content script i…	3.8.1
5	Network Interception	critical	js/instaBg.js (line 145)	The extension hooks every outgoing Instagram XHR and sniffs sensitive per-session authentication tokens (x-ig-www-claim, x-asbd-id, x-instagram-ajax) out of request headers, including from the /accounts/get_encrypted_…	3.8.1
6	Code Injection	high	js/serviceWorker.js (line 6271)	The tab URL check uses `.includes("instagram")` (substring match, not a hostname check), so any page whose URL contains the substring `instagram` anywhere — including attacker-controlled domains like `evil-instagram.c…	3.8.3
7	Credential Theft	high	js/serviceWorker.js (line 5887)	The background service worker enumerates every Instagram cookie and extracts the `sessionid` and `ds_user_id` values, which are Instagram's full-session authentication credentials. Because the extension holds `cookies…	3.8.8
8	Credential Theft	high	js/serviceWorker.js (line 742)	The service worker registers a webRequest listener that specifically watches Instagram credential/tracking endpoints — notably `/accounts/get_encrypted_credentials` — and scrapes the authenticated session headers `x-i…	3.8.8
9	Credential Theft	high	js/inject.js (line 77)	The MAIN-world script pulls Instagram's WWW claim token and internal app ID directly out of Instagram's own module graph (PolarisWWWClaim / PolarisConfig) and mirrors them into sessionStorage under __ig_www_claim / __…	3.8.1
10	Network Interception	high	js/serviceWorker.js (line 777)	When the extension itself is the request initiator, it rewrites `origin` and `referer` to `https://www.instagram.com` and injects the previously-captured auth headers (`x-ig-www-claim`, `x-asbd-id`, `x-ig-app-id`) int…	3.8.8
11	Network Interception	high	js/serviceWorker.js (line 688)	Installs a declarativeNetRequest session rule that silently spoofs the User-Agent to a mobile iPhone Safari string on every resource type (main_frame, sub_frame, scripts, XHR, websocket, etc.). This forces Instagram t…	3.8.3
12	Privilege Escalation	high	manifest.json (line 21)	The extension advertises itself as an Instagram downloader yet requests `<all_urls>` host permissions and injects two separate content script bundles plus jQuery into every frame of every site at `document_start`. Com…	3.8.8
13	Privilege Escalation	high	js/inject.js (line 311)	Runs in MAIN world on instagram.com at document_start and taps Instagram's internal React/Relay runtime via `window.require('CometRelay').fetchQuery(...)` and `window.require('PolarisRelayEnvironment')` to execute arb…	3.8.3
14	Privilege Escalation	high	js/main.js (line 5105)	The content script retrieves the harvested CSRF token and auth headers from the background, then assembles authenticated POSTs to Instagram's create/configure endpoints on the user's behalf. This primitive can be reus…	3.8.1
15	Tracking	high	js/instaBg.js (line 12)	On install, the extension beacons out to an attacker-controlled third-party domain (downloadigs.com) unrelated to the advertised Instagram-download functionality, then sets a persistence flag. This is a classic instal…	3.8.1
16	Tracking	high	js/serviceWorker.js (line 17)	The bundled service worker re-includes the same install-time beacon to downloadigs.com/api, confirming outbound contact with a third-party domain on every fresh install. The domain is not documented in the store listi…	3.8.1
17	Unauthorized Data Collection	high	js/instaBg.js (line 472)	Duplicate token-harvesting logic is shipped as a second bundle (`instaBg.js`) — identical hooks that sniff headers from `/accounts/get_encrypted_credentials` and other Instagram endpoints into local storage. Shipping …	3.8.8
18	Unauthorized Data Collection	high	js/inject.js (line 47)	Running in Instagram's MAIN world, this script reuses Instagram's internal Relay/GraphQL client (window.require('CometRelay')/PolarisRelayEnvironment) to execute arbitrary authenticated GraphQL queries against the use…	3.8.1
19	Code Injection	medium	manifest.json (line 43)	`inject.js` is loaded into Instagram pages in the MAIN world at `document_start`, meaning it executes inside the page's own JavaScript realm with direct access to Instagram's runtime, React internals, and window globa…	3.8.8
20	Network Interception	medium	js/serviceWorker.js (line 688)	The extension installs dynamic declarativeNetRequest rules that overwrite the User-Agent on every resource type (main_frame, script, xmlhttprequest, websocket, etc.) to an iPhone Safari string. Rewriting UA across all…	3.8.8
21	Network Interception	medium	js/instaBg.js (line 94)	The extension silently rewrites the User-Agent header on all request types in its managed tab to impersonate an outdated iPhone Safari build. This lets the extension bypass Instagram's desktop/mobile web detection to …	3.8.1
22	Other	medium	js/serviceWorker.js (line 5900)	The service worker builds an external URL pointing at `tryfastsave.com/insta/` using a randomized path suffix. The `[url][Math.floor(Math.random())]` pattern is a decoy array-indexing idiom suggesting the list was onc…	3.8.8
23	Tracking	medium	js/serviceWorker.js (line 6161)	On install, force-opens an active tab to `spector.net`. The helper `v()` is built as if it picks from an array of servers (`[ "https://spector.net/" ][Math.floor(Math.random())]`), which is the classic shape of a remo…	3.8.3
24	Unauthorized Data Collection	medium	js/contentScript.js (line 59)	A content script registered for <all_urls> (with Instagram excluded) injects a "Download with Spector" overlay onto every page that contains Instagram-style anchor links, and on click forwards the original Instagram U…	3.8.3
25	Unauthorized Data Collection	medium	js/storyIn.js (line 1)	storyIn.js is exposed via web_accessible_resources to `<all_urls>` and walks private React internals (`__reactFiber`, `__reactProps`) to reach into Instagram's component tree and extract story video/post URLs, includi…	3.8.3
26	Unauthorized Data Collection	medium	js/instaBg.js (line 135)	The extension ships hardcoded Instagram GraphQL query_hashes (owner/post/channel) and then dynamically learns new ones by parsing /graphql/query/ traffic on the victim's session. These private query IDs are what Insta…	3.8.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
ns.adobe.com	/Extensibility/1.0/	http://ns.adobe.com/Extensibility/1.0/
ns.adobe.com	/AdobeIllustrator/10.0/	http://ns.adobe.com/AdobeIllustrator/10.0/
ns.adobe.com	/Graphs/1.0/	http://ns.adobe.com/Graphs/1.0/
ns.adobe.com	/Variables/1.0/	http://ns.adobe.com/Variables/1.0/
ns.adobe.com	/ImageReplacement/1.0/	http://ns.adobe.com/ImageReplacement/1.0/
ns.adobe.com	/SaveForWeb/1.0/	http://ns.adobe.com/SaveForWeb/1.0/
ns.adobe.com	/GenericCustomNamespace/1.0/	http://ns.adobe.com/GenericCustomNamespace/1.0/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

péssima, não funciona, propaganda enganosa

Fernando Bragança·26 Jul 2026

got this error: Not_authorized_upload_attempt

Zakk Jackson·11 Jul 2026

支援單張圖片下載，介面簡潔，方便好用。

Leon Lai·22 Jun 2026

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Malware Risk Confirmed

FastSave

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 19 Versions26

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating