
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
instagram-private-api
Advanced tools

Nerix and I are excited to announce the next 3.x.x version of this library. It features an extended list of capabilities and is a significant release. We have substantially expanded the functionality and possibilities. The library has transformed into a monorepository and is now a set of libraries connected in an ecosystem. It consists of:
We've made some design decisions and simplified the state management process. Now, you can easily create a snapshot of the account state, save it in persistent storage, and restore a 1-to-1 copy with just one function call. With new realtime features, you can listen for new direct messages, notifications, and other events.
You can take a look at the type documentation for the next version by following this link – https://docs.igpapi.com
The new version is hosted in a private repository and access is paid. Members receive exhaustive support for the entire integration process.
Contact me in telegram or email for details.
From npm
npm install instagram-private-api
From github
npm install github:dilame/instagram-private-api
This package uses url-regex-safe (GitHub) to check for links when sending direct messages.
By default, the safe regex engine re2 is not installed.
⚠ It's highly recommended for you to install re2 by running npm install re2, else you will be vulnerable to CVE-2020-7661.
If you find this library useful for you, you can support it by donating any amount
BTC: 1Dqnz9QuswAvD3t7Jsw7LhwprR6HAWprW6
You can find usage examples here.
Note for JavaScript users: As of Node v.13.5.0, there isn't support for ESModules and the 'import'-syntax. So you have to read the imports in the examples like this:
import { A } from 'b' ➡ const { A } = require('b')
import { IgApiClient } from 'instagram-private-api';
import { sample } from 'lodash';
const ig = new IgApiClient();
// You must generate device id's before login.
// Id's generated based on seed
// So if you pass the same value as first argument - the same id's are generated every time
ig.state.generateDevice(process.env.IG_USERNAME);
// Optionally you can setup proxy url
ig.state.proxyUrl = process.env.IG_PROXY;
(async () => {
// Execute all requests prior to authorization in the real Android application
// Not required but recommended
await ig.simulate.preLoginFlow();
const loggedInUser = await ig.account.login(process.env.IG_USERNAME, process.env.IG_PASSWORD);
// The same as preLoginFlow()
// Optionally wrap it to process.nextTick so we dont need to wait ending of this bunch of requests
process.nextTick(async () => await ig.simulate.postLoginFlow());
// Create UserFeed instance to get loggedInUser's posts
const userFeed = ig.feed.user(loggedInUser.pk);
const myPostsFirstPage = await userFeed.items();
// All the feeds are auto-paginated, so you just need to call .items() sequentially to get next page
const myPostsSecondPage = await userFeed.items();
await ig.media.like({
// Like our first post from first page or first post from second page randomly
mediaId: sample([myPostsFirstPage[0].id, myPostsSecondPage[0].id]),
moduleInfo: {
module_name: 'profile',
user_id: loggedInUser.pk,
username: loggedInUser.username,
},
d: sample([0, 1]),
});
})();
You can find documentation in the docs folder.
Consider starting in IgApiClient (index module), the root class.
You'll often see ig in the docs.
This just refers to the client, an instance of IgApiClient holding the state for one user.
import { IgApiClient } from 'instagram-private-api';
// This is the general convention on how to name the client
// vv
const ig = new IgApiClient();
// login, load a session etc.
Repositories implement low-level operations - every method sends exactly one api-request.
IgApiClient here.You access repositories on the client (IgApiClient) by their lower-case (camelCase) name without the Repository suffix.
For example, you access the instance of AddressBookRepository by ig.addressBook.
Feeds represent paginated endpoints like a user's feed (UserFeed).
Think of feeds like (async-)iterators/streams/observables (in fact feeds are async iterable and observable (feed.item$)).
Every feed is accessible via ig.feed.feedName() (camelCase name). ig.feed is the FeedFactory that creates feeds for you connected to the instance of ig.
FeedFactory (ig.feed) here.Most of the feeds require initialization parameter(s), like a user-pk (id).
Services will help you to maintain some actions without calling a couple repository methods or perform complex things like pre and postlogin flow simulations or photo/video publishing.
IgApiClient here.In order to get debug infos provided by the library, you can enable debugging.
The prefix for this library is ig.
To get all debug logs (recommended) set the namespace to ig:*.
In Node you only have to set the environment variable DEBUG to the desired namespace.
Further information
If you need features that is not implemented - feel free to implement and create PRs!
Plus we need some documentation, so if you are good in it - you are welcome.
Setting up your environment is described here.
instagram-id-to-url-segment - convert the image url fragment to the media ID
FAQs
Instagram private API wrapper for full access to instagram
The npm package instagram-private-api receives a total of 36,406 weekly downloads. As such, instagram-private-api popularity was classified as popular.
We found that instagram-private-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.