npm insta-api-wrapper Stole Your Instagram Password?

Your reels helper depended on an npm Instagram wrapper. Suddenly the account follows strangers and likes spam. The password may have left the machine in plaintext. You need a dependency wipe and a session revoke order before the attacker keeps the login.

Corgea's 25 October 2026 research described npm replacing ionic-insta-api-wrapper, insta-api-wrapper and related appit-online packages after a /v2/insta/check path exfiltrated passwords and forced follows and likes. Instagram's hacked profile help and hacked account hub cover recovery after unauthorised access. This guide is about that npm supply-chain path. For risky third-party helper apps see Instagram unfollower app hacked. For a general first hour see Instagram hacked first hour. One wrong step can cost you the account, so know what you are doing before you start.

Last checked: 7 November 2026.

#Quick Answer

If an npm Instagram wrapper stole your password, remove the package, rotate the Instagram password from a clean device, revoke sessions and connected apps, then review unexpected follows and likes. Instagram Help covers hacked recovery. This is supply-chain theft, not a simple unfollower-app story.

#Dependency Wipe List

#Session Revoke Order

1. Change the Instagram password from a clean device.
2. Open login activity and end unknown sessions.
3. Remove connected apps you do not recognise.
4. Turn on two factor authentication.
5. Review email and phone on the account.

Instagram's secure your account and I Can't Log In pages help when access is unstable. Type Help Centre URLs yourself.

#Spot Unexpected Follows and Likes

Corgea noted forced follow and like behaviour after the wrapper login. Scroll Recent follows and unlike spam posts. Tell collaborators the account may have liked scam content while the token was live.

#Agency and Malaysian Dev Shops

Malaysian agencies that ship Instagram helper apps sometimes pull npm wrappers under deadline pressure. Put a dependency allowlist in the pipeline and ban packages that ask for plaintext Instagram passwords.

If a laptop may still run stealer code, treat it like a clicked malware case. See Clicked a phishing link what to do for device hygiene while you rotate secrets.

#What Only Instagram Can Decide

Instagram decides whether the login returns and whether automated behaviour triggers further limits. Your part is wiping malware dependencies and revoking sessions through official settings.

Pin the Corgea package names in your internal security channel so other repos get scanned the same day.

Rotate any Meta app secrets that lived in the same .env file as the wrapper.

Rebuild CI agents that installed the malicious versions before you trust new builds.

Ask clients whose accounts logged in through the tool to change passwords as well.

Keep a changelog of which creator accounts used the wrapper so outreach is complete.

Do not publish a public mea culpa that includes live access tokens or session dumps.

Write down the exact on-screen wording before you screenshot so later appeals match what the platform showed on the day you acted.

Tell close contacts through another channel that your account may send odd links until the situation is stable.

Prefer official help URLs you type yourself rather than buttons inside unexpected emails or DMs.

Keep a simple timeline with Malaysia time stamps for every password change, appeal and public warning.

If a platform offers only a limited number of reviews, use them carefully and attach only evidence you can defend.

After access returns, review connected apps and remove anything you do not recognise before you resume normal posting.

Teams should nominate one owner for the case so staff do not file conflicting appeals from different logins.

Ignore anyone who messages you offering a paid clear or a private tool. Stay on official help pages you open yourself.

Do not share your password, codes or session cookies with anyone who contacts you about this case.

Keep screenshots of every notice with the date in Malaysia time so later support chats match what you saw. Wording can vary by app and region.

If you already paid a stranger who promised a restore, stop further payments and move to bank and police reporting the same day.

Document which devices still have an active session so you can sign them out in order once you regain control.

A calm checklist beats rushing a second account that can create more policy problems.

Share only the facts your staff need. Over-sharing passwords in a group chat creates a second incident.

Agency leads should ban plaintext Instagram password fields in any internal tool brief.

Keep a software bill of materials for creator tools so the next npm alert is searchable.

Keep customer or member messages factual so copycats do not learn your internal recovery codes.

Store evidence in a shared drive your team already trusts rather than in the compromised chat thread.

If law enforcement asks for logs, hand over exports you already collected instead of improvising new captures.

Schedule a short debrief after access returns so the same bait does not work on the next shift.

Update internal playbooks with the exact Help Centre titles you used, including the read date.

When vendors ask for status, give them a single approved sentence rather than five conflicting staff replies.

Rehearse a calm public statement that avoids inventing timelines you cannot prove.

Check that billing cards tied to the account still belong to you after the incident settles.

Remove leftover recovery codes from screenshots before you file them in email.

Ask whether any contractor still has an active session on a personal phone.

Prefer daylight Malaysia hours for sensitive resets so more staff can watch the process.

If a platform shows a lesson or quiz after a lock, complete only the official in app flow.

Do not celebrate early if a temporary feature returns while a deeper appeal is still open.

Keep printer access to the incident folder limited to people who need it.

Close the loop with anyone who received a scam message from your account during the outage.

Rotate any shared CI secrets that lived beside the malicious wrapper install.

Keep client notification templates ready so creator partners hear the same facts.

#When It Is Safer to Get Expert Help

Getting help is safer when several creator accounts shared the wrapper, when you cannot tell which sessions are clean, or when Instagram already limited the login. Wrong DIY steps such as reinstalling the same package deepen the theft.

If you are unsure about any step, or client accounts matter to your income, having an experienced team check it is the safer choice. AwareXone does this work. See our account security page.

#When a Case Review Makes Sense

A case review helps when npm theft, multiple creator logins and device malware sit together. We are a Malaysia-based team, independent of Instagram and Meta, and we use only the official routes. We do not ask for your password or codes, and we cannot promise a result. See our trust page.

#Frequently Asked Questions