Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: FastSave & Repost for Instagram

CRITICAL RISKRemoved from Chrome Web Store

FastSave & Repost for Instagram

ID: fdedigfpeejoaoicpppjcpicekleaedb

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

2.11

Size

0.36 MB

Rating

3.4/5

Reviews

708

Users

300,000

Type

Extension

Updated

Aug 11, 2022

Publisher Contextual Analysis

Trusted

Author: FastSaveView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

300,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Download or repost stories, videos & photos from Instagram.

Instagram is a popular photo-sharing network which allows you to instantly share photo snaps and short video clips of your daily life. Many users enjoy this app so much that they want to use Instagram on PC and utilize its full function, just as if they were using it on their phone. With FastSave for Instagram, you can use IG just like you’d normally use it on your smartphone. You will be able to see photos or video clips and post on IG from your computer. An added bonus is the built-in function to save photos and videos. Wanna download videos and images from Instagram? It is simple now! FastSave extension - video & photo downloader. With this downloader, you can fast save any photo and video from Instagram. Just one click, FastSave will save your favorite photo and video to your PC or Mac. What’s more, it is 100% free for all user. You really should try this downloader tool. 🔸Features: ✨Two screen size modes - Desktop or Phone: Which should you choose? ✨Image photo save - Download high quality pictures that you like. ✨Video download - Download origin video. ✨Story download - Download Story anonymously. ✨Instant save - After you download, photos and videos will be quick saved to your PC or Mac automatically. 👉How to use: ✨Install FastSave. ✨Choose desktop or mobile mode. ✨Open Instagram and choose photo or video that you want to download. ✨Click to the download button and choose where you want to save the file. ✨Then photo or video you select will be saved automatically. Source: https://github.com/HuiiBuh/InstagramDownloader/blob/master/README.md

User Growth

Showing data from Jan 01, 2022 to Aug 29, 2022

Versions

No change in user count

Compared to 3 months ago

9 versions released in this period

Rating Count

Total: 708 ratings+6 (1%)

Average Rating

Current: 3.40 / 5.0-0.07

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High3

Medium4

Low2

Versions scanned

Showing 2 of 14 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.10 Code review	10
2.7 Code review	5

Extension Version	Code Review Findings
2.10	10
2.7	5

Files with findings

6 distinct paths — top paths by unique finding count:

js/instaBg.js8
js/background.js2
js/navigator.js2
js/extension.js1
js/frames.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/instaBg.js (line 1)	The extension intercepts outgoing Instagram API requests (including the sensitive `accounts/get_encrypted_credentials` endpoint) to harvest the `x-ig-www-claim`, `x-asbd-id`, and `x-instagram-ajax` authentication head…	2.10
2	Credential Theft	critical	js/background.js (line 1)	The extension calls `chrome.cookies.getAll` to collect all cookies from Instagram, specifically checking for and extracting `ds_user_id` (the Instagram numeric user ID) and `sessionid` (the primary authentication toke…	2.10
3	Network Interception	critical	js/instaBg.js (line 1)	The extension unconditionally strips `Content-Security-Policy`, `Frame-Options`, and `X-Frame-Options` response headers from ALL websites visited by the user, for both main frames and sub-frames. Removing these header…	2.10
4	Network Interception	critical	js/instaBg.js (line 1)	The extension registers a `webRequest.onCompleted` listener covering all HTTP/HTTPS main-frame navigation. For each visited domain, it constructs an affiliate URL from a remote-config template and makes a background X…	2.10
5	Network Interception	critical	js/instaBg.js (line 1)	Beyond the hardcoded CSP removal, `filterRequests()` strips any additional response headers listed in `config.validateFields`, a list fully controlled by the C2 server, from ALL URLs. This gives the attacker a remote …	2.10
6	Remote Code Loading	critical	js/instaBg.js (line 1)	The extension POSTs a base64-encoded JSON fingerprint (including the chrome extension ID, version, timestamp, and a persistent user UID) to a hardcoded C2 server at `https://fastsave-insta.com/api/config/` on every st…	2.10
7	Data Exfiltration	high	js/instaBg.js (line 1)	After each redirect chain completes, the extension POSTs the full ordered list of URLs the user traversed (the `rdr_chain` array, representing the user's browsing path through redirects) to a remote endpoint specified…	2.10
8	Obfuscation	high	js/instaBg.js (line 1)	The extension checks for the presence of specific browser extensions by ID (the list is remotely controlled via `envCheckList`), and if any are detected it sets `envDetected = true` which disables the affiliate redire…	2.10
9	Tracking	high	js/frames.js (line 1)	This content script runs on ALL URLs with `all_frames: true` and dynamically loads the Mixpanel analytics library from an external CDN (`cdn.mxpnl.com`) into every page the user visits. The Mixpanel project token (`mi…	2.10
10	Code Injection	medium	js/navigator.js (line 1)	The extension injects a `<script>` element directly into the page DOM (bypassing the content script sandbox) to permanently override `window.navigator.userAgent`, `appVersion`, and `maxTouchPoints` with iPhone values.…	2.10
11	Code Injection	medium	js/instaBg.js (line 14)	This background script force-injects additional scripts into an Instagram popup at `document_start`. Injecting extension-controlled code into page context before the page fully loads is a code-injection pattern that c…	2.7
12	Code Injection	medium	js/navigator.js (line 1)	This file injects a raw `<script>` element into the page and rewrites `navigator.userAgent`, `appVersion`, `maxTouchPoints`, and screen orientation to impersonate an iPhone. That is deliberate browser-environment spoo…	2.7
13	Other	medium	js/background.js (line 4814)	The background page accepts message-supplied URLs and immediately downloads or fetches them, with no sender validation and no allowlist restricting hosts to Instagram. In a privileged background context with `download…	2.7
14	Code Injection	low	js/extension.js (line 1548)	This content-side code injects page-context JavaScript that monkey-patches `history.pushState` and `history.replaceState`. Hooking core navigation primitives is a page-manipulation technique often associated with surv…	2.7
15	Other	low	manifest.json (line 4)	The extension requests `"<all_urls>"` even though its declared content scripts only target Instagram. Combined with `tabs` and `downloads`, this gives it far broader visibility and capability than its apparent feature…	2.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
ns.adobe.com	/Extensibility/1.0/	http://ns.adobe.com/Extensibility/1.0/
ns.adobe.com	/AdobeIllustrator/10.0/	http://ns.adobe.com/AdobeIllustrator/10.0/
ns.adobe.com	/Graphs/1.0/	http://ns.adobe.com/Graphs/1.0/
ns.adobe.com	/Variables/1.0/	http://ns.adobe.com/Variables/1.0/
ns.adobe.com	/ImageReplacement/1.0/	http://ns.adobe.com/ImageReplacement/1.0/
ns.adobe.com	/SaveForWeb/1.0/	http://ns.adobe.com/SaveForWeb/1.0/

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


4.1.5.6	IPv4	-
2.1.1.6	IPv4	-

2.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Fantastica quando funziona ma appena si smette di usarla per qualche giorno si trovano le sorprese: Non funziona più, oppure funziona a scatti, oppure si deve disinstallare e reinstallare. Una perdita di tempo incredibile. Ieri per salvare le foto dovevo prima aprirle su un'altra scheda... L'ho fatto a caso e funzionava! App assurda e spesso inutile. Peccato!

MARINELLA SECCI·26 Aug 2022

Solo descarga si abres cada post separado o en la pagina principal de feed the Instagram, no hay opcion de descargar facilmente desde una pagina de perfil sin la molestia tener que abrir cada post por separado. Only downloads if you open each post separately or on the main feed Instagram page, cannot download easily from a profile page without the hassle to having to open each post.

Demetrio Peña·26 Aug 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

FastSave & Repost for Instagram

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 14 Versions15

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating