INSSIST | Web Client for Instagram
bcocdbombenodlegijagbhdjbifpiijp
Risk Score
5.10
Risk Level:
Medium
Recommendation:
🟡 MEDIUM RISK — review
Top Risks
- Privacy policy admits data collection & third-party sharing but is not scoped to this extension — v3.5 D applies (+10.0 privacy).
- Brand impersonation: extension is named/themed around Instagram without confirmed ownership; is_impersonation=true.
- cookies permission + full Instagram host access enables session-cookie exfiltration.
- Developer domain slashed.io does not resolve; verified-publisher discount capped per invariant 0c.
- 11 external JS hosts including unpkg.com, raw.github.com, stuartk.com — broad third-party CDN surface.
Evidence
- brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[instagram], confirmed_owner=false.
- privacy_policy_broad_admission api scope_extension=false, data_collection=true, third_party_sharing=true → v3.5D +10.0 privacy.
- developer_domain_not_resolving api slashed.io resolves=false; verified-publisher discount capped at -1.0 per invariant 0c.
- cookies_high_perm_with_host manifest cookies + *://*.instagram.com/* enables Instagram session-cookie access.
- external_js_hosts_broad crx 11 external hosts including unpkg.com, raw.github.com, stuartk.com, stuk.github.io outside dev control.
- function_constructor_in_bundled_lib crx new Function() in js/jszip.min.js; bundled lib, limited scope but dynamic code execution path.
- verified_publisher store verified_publisher=true but domain does not resolve; discount capped to -1.0 per 0c.
- no_developer_name store developer_name is empty string; reduced accountability signal.
Permissions Breakdown
- alarms low Scheduled background tasks; low direct harm potential.
- background low Persistent background page; needed for Instagram client function.
- cookies high Can read/write Instagram session cookies; session hijack risk paired with host access.
- declarativeNetRequest medium Can block/modify network requests; lower risk than webRequestBlocking but still capable.
- offscreen low Offscreen document for media ops; limited standalone risk.
- unlimitedStorage low Unlimited local storage; no direct privacy harm.
- *://*.instagram.com/* high Full access to Instagram pages; combined with cookies raises session-theft risk.
- *://*.inssist.com/* medium Access to developer's own domain; data relay risk.
Pillar Scores
Permissions5.50
Reputation6.00
Network4.50
Webstore5.50
Maintenance0.00
Privacy10.00
Code Quality2.50
CVE Exposure0.00
Scoring History
| <fsssiedxa xx psssiedx | 4.67 | Medium | review | 2026-08-24 |
| <fsssiedxa"sssiedx | 4.47 | Medium | review | 2026-08-24 |
| <fsssiedxa"sssiedx | 4.41 | Medium | review | 2026-08-24 |
| <fsssiedxa'sssiedx | 4.36 | Medium | review | 2026-08-24 |
| <fsssiedxa$'sssiedx | 4.13 | Medium | review | 2026-08-24 |
| "fsssiedxd xx psssiedx | 4.74 | Medium | review | 2026-08-23 |
| 'fsssiedxdfdsaxax><!--></ScRiPt>asddsssiedx | 4.49 | Medium | review | 2026-08-23 |
| 4.56 | Medium | review | 2026-08-23 | |
| <fsssiedxd"sssiedx | 4.47 | Medium | review | 2026-08-23 |
| fsssiedxd<sssiedx | 4.38 | Medium | review | 2026-08-23 |
| <fsssiedx{'sssiedx | 4.55 | Medium | review | 2026-08-23 |
| <fsssiedxa$"sssiedx | 5.16 | Medium | review | 2026-08-19 |
| <fsssiedxa'sssiedx | 4.22 | Medium | review | 2026-08-19 |
| <fsssiedxafdsaxax><!--></ScRiPt>asddsssiedx | 4.34 | Medium | review | 2026-08-19 |
| fsssiedxa<sssiedx | 4.43 | Medium | review | 2026-08-19 |
| v3.6"><script>aDKm(9627)</script> | 4.48 | Medium | review | 2026-08-05 |
| dfb[[${98991*97996}]]xca | 4.17 | Medium | review | 2026-08-05 |
| <th:t="${dfb}#foreach | 4.31 | Medium | review | 2026-08-05 |
| v3.6&n955439=v933546 | 4.49 | Medium | review | 2026-08-05 |
| v3.6"sTYLe='zzz:Expre/**/SSion(QpNR(9826))'bad=" | 4.77 | Medium | review | 2026-08-04 |
| v3.6&n993613=v989336 | 4.19 | Medium | review | 2026-08-04 |
| <fsssiedx{ xx psssiedx | 4.51 | Medium | review | 2026-07-30 |
| <fsssiedx{'sssiedx | 4.39 | Medium | review | 2026-07-30 |
| <fsssiedx{$'sssiedx | 4.81 | Medium | review | 2026-07-30 |
| <fsssiedx{$"sssiedx | 5.47 | Medium | review | 2026-07-30 |
| <fsssiedx{fdsaxax><!--></ScRiPt>asddsssiedx | 4.89 | Medium | review | 2026-07-30 |
| <fsssiedx{"sssiedx | 4.75 | Medium | review | 2026-07-30 |
| <fsssiedx{"sssiedx | 5.07 | Medium | review | 2026-07-30 |
| fsssiedx<sssiedx | 5.18 | Medium | review | 2026-07-30 |
| fsssiedxd xx psssiedx | 4.87 | Medium | review | 2026-07-30 |
| fsssiedxd | 5.05 | Medium | review | 2026-07-30 |
| fsssiedxd$'sssiedx | 4.64 | Medium | review | 2026-07-30 |
| sssieddrubricxsx | 4.78 | Medium | review | 2026-07-30 |
| v3.69653"();}]9982 | 4.83 | Medium | review | 2026-07-29 |
| v3.6" Zm6k=BPy0([!+!]) iNG=" | 4.47 | Medium | review | 2026-07-29 |
| dfb{{98991*97996}}xca | 4.65 | Medium | review | 2026-07-29 |
| bfg3157＜s1﹥s2ʺs3ʹhjl3157 | 4.27 | Medium | review | 2026-07-29 |
| 1}}"}}'}}1%>"%>'%><%={{={@{#{${dfb}}%> | 4.41 | Medium | review | 2026-07-29 |
| v3.69466987 | 4.44 | Medium | review | 2026-07-29 |
| v3.6&n993791=v995300 | 4.72 | Medium | review | 2026-07-29 |
| v3.6 | 5.10 | Medium | review | 2026-06-16 |
Bookkeeping
Rubric v3.6
Scored at 2026-06-16 07:19
Listing SHA
b974357486a8…
Force block
— not fired
Score recovered
no
Elapsed
24.0s