MAL-2026-4588 — Malicious code in ionic-insta-api-wrapper (npm)

The package ionic-insta-api-wrapper presents itself as an Instagram API wrapper but forwards users’ Instagram credentials, session data, and lookup information to a hardcoded third-party server and accepts server-supplied commands to perform actions on users’ accounts.