
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Supply Chain Security
Vulnerability
Quality
Maintenance
License
Unpopular package
QualityThis package is not very popular.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
insta_api is a pythonic (unofficial) instagram client. It has been backwards engineered from the ground up. Currently it supports essential behavior such as liking, following other users, as well as posting photos.
To install simply do:
$ pip install insta_api
The first thing you should do is import the insta_api
module
from insta_api import insta_api
Login to your instagram account
insta = InstaAPI()
insta.login(USERNAME, PASSWORD)
You can like posts by either using shortcode or media_id. The shortcode can be obtained by looking at the URL of a post in the addressbar.
It looks something like this Bov3uZUFJRh
insta.like(shortcode)
If you are a more advanced user, you may want to use the media_id instead, this will also work.
To follow an user you need one of two things: either their username or their unique user id
For example, to like by username:
insta.follow(my_username)
See the documentation for more info.
You must set up your own testing server, like Jenkins, for example. This is because instagram will block any of the online CI integration tools due to the nature of their dynamic IPs
You should also configure your testing instagram credentials by adding the INSTA_API_USER
and INSTA_API_PASSWORD
environmental variables to your isolated testing system.
Copyright (c) 2013 Orlando Diaz
For more info see LICENSE
This program is in no way affiliated with, authorized, maintained, sponsored or endorsed by Instagram or any of its affiliates or subsidiaries. This is an independent and unofficial API. Use at your own risk
FAQs
Unofficial instagram API
We found that insta-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.