GCVE-110-OSM-2026-14183

The exfil file content is unambiguous: after performing a real Instagram login on behalf of the user, the package immediately POSTs the plaintext username, password (`pass`), and full login response body to `https://reelsaver.appit-online.de/v2/insta/check` — an attacker-controlled endpoint operated by the same publisher. This is a credential-harvesting supply chain attack: the library presents itself as a legitimate Instagram API wrapper for Ionic apps, but silently exfiltrates Instagram credentials to a custom C2 on every login call. The `search.js` and `handler.js` `encodeURIComponent(password)` findings corroborate that passwords are being handled and transmitted. The publisher (`dave7117`) already has a confirmed malicious package (`cordova-plugin-geofence-appit`) in OSM, and the operator's own `reelsaver.appit-online.de` domain is the exfil endpoint, making this a deliberate, publisher-operated credential theft campaign rather than a compromise. Entrypoint: lib/index.js (main: lib/index.js) Exfil: https://reelsaver.appit-online.de/v2/insta/check (custom-c2, recovery: plaintext in lib/lib/handler.js) Payload: lib/lib/handler.js Secondary files: lib/lib/search.js, lib/utils/index.js Key findings: - Startup Persistence in lib/lib/client.service.js: ".profile" - Data Encoding for Exfiltration in lib/lib/handler.js: "encodeURIComponent(pass" - Data Encoding for Exfiltration in lib/lib/search.js: "encodeURIComponent(password" - Dynamic Code Execution in lib/utils/index.js: "exec(url)" - Publisher Has Other Malicious Packages IOCs: - ipv4: 177.0.0.30 - urls: https://scontent-muc2-1.cdninstagram.com/o1/v/t2/f2/m78/AQOcKHtdfCkfdfJ5XMY96xY4_IiwMQ7vvgM9U1Yo-lcutWgH9AfdDbofL1f8Y13r7g647Gk.mp4, https://reelsaver.appit-online.de/v2/insta/check, https://reelsaver.appit-online.de/v2/insta/verify, https://quicktype.io, https://paypal.me/dave7117 - domains: scontent-muc2-1.cdninstagram.com, 2Fexample.com, via.placeholder.com, quicktype.io, paypal.me - payloadFileHash: 2569999371e8a0862105562de826d5baaed348187ab93ff0b9457bffa97ab1f6