Is Bulk Downloader for Instagram - Download Video, Story, Reels & Photo safe?
We analyzed Bulk Downloader for Instagram - Download Video, Story, Reels & Photo version 1.0.3's actual code and gave it a 76/100 trust score. This…
Bottom line
This appears to be a mostly purpose-aligned Instagram downloader with moderately sensitive access and some avoidable tracking and installation behavior.
What it can access
The extension can read and modify Instagram pages and use Instagram cookies and selected request details to retrieve media. [Q2][Q4] These permissions are broadly consistent with downloading Instagram content, but they are more sensitive than a simple page button. [Q1][Q4]
Security weaknesses
It opens a vendor page after installation and can begin prepared downloads without showing a save prompt. [Q8] Its compressed code makes independent review harder, while the reviewed remote notice path supplies display content rather than executable code. [Q7][Q10]
Signs of misuse
The reviewed package shows no established sending of Instagram cookies, session details, or page contents to a separate vendor service. [Q14] It does send limited installation or feedback metadata and monitors selected Instagram activity for downloader operation. [Q6][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access to Instagram pages, related media services, cookies, tabs, network observations, storage, and downloads; this broadly fits a downloader, but cookie and request access are sensitive.
The extension requests activeTab, storage, downloads, tabs, cookies, and webRequest, with access to Instagram, cdninstagram.com, and wadesk.io. — manifest.json:1
Its page access is limited to Instagram matches, where it reads and changes page content for media downloading. — manifest.json:1
It reads Instagram's csrftoken cookie and selected Instagram request headers to retrieve media in the signed-in Instagram context. — background.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.instagram.com/*, *://*.cdninstagram.com/*, *://*.wadesk.io/* — manifest.json:1
Content scripts run directly on: *://*.instagram.com/*, *://*.instagram.com/* — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension runs on Instagram pages and reads Instagram page data and authentication-related values, but the reviewed code does not capture passwords, payment details, messages, or arbitrary form entries. No path from typed sensitive fields to an external destination was established.
Runs in the Instagram page main world and reads page-provided Instagram state; no password, payment, message, or general form-field exfiltration path is established. — content-scripts/parse.js:1
Handles Instagram page and media operations rather than a demonstrated general keystroke or form-capture sink. — content-scripts/dom.js:1
The main-world content script is restricted to Instagram URL matches. — manifest.json:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension can access selected private Instagram data, including the Instagram csrftoken cookie and authentication headers from Instagram requests. It does not thereby gain general browsing history, bookmarks, or downloads history.
Requests cookies, tabs, and webRequest permissions with Instagram host coverage. — manifest.json:1
Reads the csrftoken cookie for the tab's cookie store and captures selected x-ig-app-id, x-ig-www-claim, and x-asbd-id request headers. — background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends requests to Instagram to retrieve profile and media data, using selected Instagram authentication information and the csrftoken. It also contacts wadesk.io for an urgent notice and muxdesk.com for installation or uninstall-feedback pages; no user content was shown being sent to those latter services.
Fetches Instagram profile-media endpoints with credentials included and selected authentication headers, and reads the csrftoken for those requests. — background.js:1
Fetches the remote urgent-notice JSON from cdn.wadesk.io and constructs muxdesk.com installation and uninstall-feedback URLs. — background.js:1
Performs Instagram page and media requests for downloader functionality. — content-scripts/dom.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The service worker downloads a JSON urgent notice from cdn.wadesk.io, caches it, and returns its urgentNotice value to the extension. The reviewed code does not execute the response as JavaScript.
Fetches and parses the fixed urgentNotice_instagram_new.json URL, then stores the returned urgentNotice object in extension storage. — background.js:1
The value is returned through GET_URGENT_NOTICE; no eval, Function constructor, script injection, or dynamic import of the response is established. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After installation, it automatically opens a muxdesk.com guide and sets an uninstall-feedback URL, and Instagram content scripts make initialization requests without a separate click. Downloads are initiated through extension messages and are not themselves automatically started merely by visiting an unrelated website.
The onInstalled handler opens the vendor installation guide, and startup sets a vendor uninstall-feedback URL. — background.js:1
The document-start main-world script initializes on matching Instagram pages and communicates with the page. — content-scripts/parse.js:1
The DOWNLOAD_FILE handler calls downloads.download with saveAs:false when a valid extension message reaches it. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important code is difficult to inspect because the service worker and content scripts are compressed into very long single lines, while the popup is a large generated bundle. This reduces auditability but is not, by itself, evidence of malicious behavior.
The complete service worker is compressed into one line. — background.js:1
The large content script is compressed into one line. — content-scripts/dom.js:1
The approximately 1.16 MB popup bundle is generated/minified into one line. — chunks/popup-BGrr78XQ.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No use of eval(), new Function(), or string-based timers was found in the searched extension source. The bundled/minified format limits absolute certainty.
Reviewed service-worker code contains fetch, storage, cookie, tab, and download logic but no identified eval/new Function/string timer. — background.js:1
Reviewed page-world script uses timers with function callbacks, not text-to-code evaluation. — content-scripts/parse.js:1
Does it track the websites, pages, searches, or links you visit?
It records selected Instagram request headers and recognized GraphQL query identifiers per tab in session storage. This is narrow operational monitoring of Instagram requests, not general tracking of every website, search, or link visited.
webRequest listeners inspect Instagram XMLHttpRequests and store selected headers and recognized query document IDs keyed by tab. — background.js:1
webRequest permission and host permissions are limited to the declared Instagram-related hosts. — manifest.json:1
Does it create a persistent ID or browser fingerprint to recognize you?
The code stores an installation timestamp and extension ID for installation/uninstall links, but no browser fingerprint or user-recognition identifier was found.
Stores install_timestamp and adds the extension ID and install time to the uninstall-feedback URL. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension reads the Instagram csrftoken and selected authentication headers, then sends them to Instagram endpoints for the downloader's requests. No path was established that forwards those credentials, cookies, or page contents to a separate third-party server.
Reads csrftoken and combines it with captured Instagram headers for requests to i.instagram.com. — background.js:1
The other vendor network paths fetch fixed notice data or construct feedback/install URLs; they do not receive the cookie or page contents in the reviewed code. — background.js:1
Uses Instagram requests for media retrieval rather than demonstrating third-party credential exfiltration. — content-scripts/dom.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records typing, form entries, clipboard data, or screenshots.
The main-page script observes DOM changes and extracts media identifiers, not keystrokes or clipboard data. — content-scripts/parse.js:1
Can a website or remote server send commands that make the extension take actions?
The service worker accepts messages from extension contexts for media lookup, downloads, and notices, but the reviewed code does not establish a remote website or server command channel. The main-world page messaging path is used for Instagram-page coordination rather than granting the page privileged extension APIs.
Runtime handlers recognize GET_PROFILE_MEDIA_PAGE, DOWNLOAD_FILE, and GET_URGENT_NOTICE; unrecognized message types return false. — background.js:1
Profile-media handling checks the sender tab, top frame, Instagram URL, username, and current page before using cookies and requests. — background.js:1
Handles named IGDL_STORIES page messages, but no established path sends arbitrary page commands directly to privileged service-worker actions. — content-scripts/parse.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The code is focused on collecting Instagram media URLs and downloading them. No link, referral-code, advertisement, shopping-cart, or search-result modification was found.
Builds media metadata and download URLs from Instagram responses. — content-scripts/dom.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It observes selected Instagram request headers and GraphQL request bodies to obtain API parameters, but I found no code that redirects traffic, changes headers, modifies downloads in transit, or changes proxy settings.
webRequest listeners capture only selected Instagram headers and GraphQL identifiers into session storage. — background.js:1
Declares webRequest permission, but the source shown uses it for observation rather than request blocking or modification. — manifest.json:3
Can it communicate with software on the computer or services running on localhost?
No native-messaging connection, localhost request, or communication with local computer software was found.
No nativeMessaging permission is declared; host permissions list Instagram, CDN Instagram, and wadesk origins. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No decryption, unpacking of hidden payloads, dynamic code execution, or script injection was found in the inspected runtime code.
The script extracts Instagram configuration and media IDs and initializes a DOM observer. — content-scripts/parse.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary webpages do not receive the extension's privileged APIs merely because a content script runs on Instagram. The main-world script uses named window messages for page coordination, while privileged operations remain in the isolated content script or service worker with validation.
Content scripts match only Instagram URLs; no web-accessible resources are declared. — manifest.json:1
The main-world script listens for named IGDL_STORIES messages and exchanges page data, without exposing extension APIs directly. — content-scripts/parse.js:1
Privileged handlers are runtime messages in the service worker, and profile requests validate the sender tab/frame and Instagram URL before reading cookies or querying Instagram. — background.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Some behavior is conditional: it runs on Instagram pages, uses the current page’s authentication state, and fetches remote urgent notices. It also creates an install guide tab only on first installation.
Restricts profile requests to Instagram URLs and checks the current tab, Instagram cookies, and captured headers. — background.js:1
Fetches a remote urgent-notice JSON file and caches it for 15 minutes. — background.js:1
The onInstalled handler opens an install-guide URL only when the install reason is install. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining code or other concealed resource-intensive computation was found. Network and media-processing work is directly related to downloading Instagram content.
Fetches media information and streams media for downloads. — content-scripts/dom.js:1
Does it change form fields or where a form sends its information?
No code was found that changes form fields or form submission destinations.
Modifies only extension-specific media-ID attributes on page elements and observes DOM changes. — content-scripts/parse.js:1