Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: Instant Downloader

CRITICAL RISK

Instant Downloader

ID: pblgjchnlklkdkhcafceklibimpdfgbe

Extension Info & Metadata

Status

Active

Version

3.1

Size

0.48 MB

Rating

2.8/5

Reviews

Users

5,000

Type

Extension

Updated

Nov 15, 2022

Publisher Contextual Analysis

Author: David MaílloView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,109

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Download one or multiple pictures from Instagram. ✨

This extension helps you to download all the images from an Instagram's user profile page in a click. Navigate on a user profile and you will have an icon in your bottom-right corner of your screen. It opens a popup with every single image ready to be downloaded and the option to "Download all" at the same time. Note: This app will work till the Instagram changes its structure. We will try to update the app if Instagram changes but cant guarantee it CHANGELOG Version 3.1 (November 2022) ----------------- - Fix: "Download all" button works again. - Added more text instructions and simplified the extension. Version 3.0 (June 2020) ----------------- - Removed storage permissions to accomplish new Chrome Store policy. Only need to accept download permissions to download the images on Instagram. - Added images counter. - Added instructions of use. - Fix: Only retrieves post images (not images in profile picture nor highlighted stories). - Fix: Refresh the image counter on scroll. Version 2.0.1 (Apr 6, 2018) ---------------------------- * Multi-language: English / Spanish. Version 2.0 (Mar 28, 2018) ---------------------------- * Full re-design for minimal non-intrusive interface. * Easier to use: One click and instants are displayed in a grid. Download button downloads em all. * New download system that works perfectly after the latest Google Chrome version update. Version 1.0.4 (Mar 20, 2017) ---------------------------- * Renamed to Instant Downloader, due to Instagram's trademark conditions. Version 1.0.2 (Jan 4, 2017) ---------------------------- * Added JSZIP lib to download as ZIP. * Downloads real image size. * Downloads videos as well. Please note: This application is not provided by Instagram company. It's made by users for users.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 38 ratings+1 (3%)

Average Rating

Current: 2.66 / 5.0-0.08

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High0

Medium2

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.1 Code review	4

Extension Version	Code Review Findings
3.1	4

Files with findings

3 distinct paths — top paths by unique finding count:

js/instagram.js2
js/background.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	manifest.json (line 27)	The extension declares `optional_host_permissions: [":///*"]`, granting it the ability to request read/write access to every URL the user visits — far beyond the stated Instagram-only functionality. While technicall…	3.1
2	Tracking	medium	js/background.js (line 9)	The extension registers a Google Forms URL as its uninstall callback via `chrome.runtime.setUninstallURL`. When the extension is removed, Chrome automatically navigates to this third-party URL, enabling the developer …	3.1
3	Unauthorized Data Collection	medium	js/instagram.js (line 415)	The `collectImages()` function indiscriminately harvests the `src` URLs of all images larger than 250px from the entire Instagram page DOM and accumulates them in a persistent array. These CDN URLs often embed ephemer…	3.1
4	Code Injection	low	js/instagram.js (line 373)	Image URLs harvested from the page are concatenated directly into an HTML string and injected into the DOM via jQuery's `.append()` without any sanitization or escaping. If an attacker could influence an image `src` a…	3.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.apache.org	/licenses/LICENSE-2.0	http://www.apache.org/licenses/LICENSE-2.0
instagram.com	/leomessi	https://instagram.com/leomessi
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

整體來說還蠻��速的，尤其是想要一次抓取比較多頁面的��候，但是也是要點進去個人頁面才可以

蔡

蔡佩萱·21 Jul 2023

整體來說還蠻��速的，尤其是想要一次抓取比較多頁面的��候，但是也是要點進去個��面才可以

蔡

蔡佩��·21 Jul 2023

整體來說還蠻快速的，尤其是想要一次抓取比較多頁面的時候，但是也是要點進去個人頁面才可以

蔡

蔡佩萱·21 Jul 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

Instant Downloader

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating