Extension Auditor
Extension Auditor
Sign Up

Instastalk

ID: ebpmpkiabmjgiomijjnplanekkliilae

Could be malicious

Supported Languages

🇬🇧British English

Extension Info & Metadata

Status
Removed
Version
2.2
Size
0.89 MB
Rating
3.4/5
Reviews
7
Users
5,697
Type
Extension
Updated
Sep 1, 2022
Category
1_communication
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Trusted
Author
stiubhartView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
2
Active
1
Obsolete
1
Listed
1
Unlisted
1
Total Users
5,710

Secretly watch Instagram stories without anyone knowing. Now you can download the story so you can keep forever!! Wooooo

**Updated for Instagram and Chrome V3 changes** Secretly watch Instagram stories without anyone knowing. Simply toggle the icon in your toolbar to turn incognito mode on/off Now you can download the story or feeds video / image so you can keep forever!! Wooooo

Item
Type
Severity
Description
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.

By severity

Critical0
High0
Medium3
Low2

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
2.15

Files with findings

3 distinct paths — top paths by unique finding count:

  • content-script.js3
  • background.js1
  • script.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Code Injection
medium
content-script.js (line 58)The content script injects a web-accessible script (`script.js`) directly into the Instagram page DOM. This is a classic script injection pattern that runs extension code in the page's world, bypassing content script …
2.1
2Network Interception
medium
background.js (line 2)The extension's primary advertised feature is silently blocking the `stories/reel/seen` network request to Instagram's API, preventing Instagram from recording that the user viewed a story. This is a deliberate decept…
2.1
3Unauthorized Data Collection
medium
script.js (line 47)The injected page-world script fetches Instagram media URLs (images and videos from stories and feeds) and triggers browser downloads by programmatically creating and clicking anchor elements. While user-initiated thr…
2.1
4Code Injection
low
content-script.js (line 34)Click handlers are wired via `setAttribute('onclick', '...')` string literals, which rely on the injected `script.js` functions (`getStoryContent`, `getContentFeed`) being available in the page's global scope. This co…
2.1
5Other
low
content-script.js (line 22)The extension polls the Instagram DOM every 50ms using two aggressive `setInterval` loops to inject UI elements into story and feed containers. Running at 20 Hz continuously is performance-hostile and typical of persi…
2.1
URLs
12
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
www.w3.org/1999/02/22-rdf-syntax-nshttp://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com/xap/1.0/mm/http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com/xap/1.0/sType/ResourceRefhttp://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
www.instagram.com-https://www.instagram.com/
instagram.com-https://instagram.com/
www.w3.org/2000/svghttp://www.w3.org/2000/svg
www.w3.org/1999/xlinkhttp://www.w3.org/1999/xlink
Showing 1 to 10 of 20 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In