Is Mass Downloader for IG – Safe Bulk Download safe?
We analyzed Mass Downloader for IG – Safe Bulk Download version 4.6's actual code and gave it a 58/100 trust score. This appears to be a real Instagram…
Bottom line
This appears to be a real Instagram bulk downloader, but its sensitive access and tracking-related behavior warrant caution.
What it can access
It can alter Instagram pages, inspect selected Instagram requests and cookies, and save files; this generally supports bulk downloading but gives it sensitive signed-in browser access [Q2] [Q4] [Q8] [Q18]. Access is limited to Instagram and the extension's related websites, rather than all sites [Q2
Signs of misuse
The package sends feature or account-related information to configured services and creates persistent installation or session identifiers [Q6] [Q13]. Raw cookie theft, broad browsing tracking, and arbitrary remote commands were not established, but large generated bundles and remote settings make a
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests Instagram page access, cookie and request visibility, storage, alarms, and download control. This broadly fits its Instagram bulk-downloading purpose, but cookie access and request inspection are sensitive and more powerful than downloading alone requires.
The manifest declares storage, alarms, downloads, cookies, and webRequest permissions, plus access to Instagram and the extension's own websites. — manifest.json:1
Content scripts run on Instagram, igmate.net, and igmate.me pages. — manifest.json:1
The service worker reads selected Instagram cookies and maintains session state. — static/background/index.js:37
The service worker inspects selected Instagram request headers and handles downloads. — static/background/index.js:86
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://*.instagram.com/*, https://igmate.net/*, https://igmate.me/* — manifest.json:1
Content scripts run directly on: https://igmate.net/*, https://igmate.me/*, https://*.instagram.com/*, https://*.instagram.com/*, https://*.instagram.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The inspected code does not establish collection of passwords, payment details, messages, or arbitrary form entries. However, several multi-megabyte content scripts are generated bundles, so complete coverage of everything running on Instagram pages is not verified.
Content scripts run on Instagram and igmate.net/igmate.me pages, giving them page access within those host matches. — manifest.json:25-50
The readable page script inspects selected Instagram response data and request paths, not form values. — assets/story-identity-main.js:132-187
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The service worker can read selected Instagram cookies and inspect Instagram request headers. This establishes access to authentication-related browser data, but the inspected logging stores selected metadata and does not by itself prove that raw cookie values are sent elsewhere.
The extension declares cookies and webRequest permissions. — manifest.json:1
The service worker calls chrome.cookies.get for https://www.instagram.com and maintains an Instagram session snapshot. — static/background/index.js:37
Instagram request interception examines request headers. — static/background/index.js:86
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends network requests to configured remote services and fetches Instagram media or other resources. The inspected code establishes outbound communication, although the exact complete payload and server inventory are not fully readable from the generated bundles.
The background API client performs fetch requests using runtime configuration. — static/background/index.js:37
The service worker POSTs to the configured remote-configuration URL. — static/background/index.js:86
The options bundle contains configured API-request handling for feedback and related operations. — options.95eda3f3.js:272
Does it download or run code, settings, or instructions supplied by a remote server?
The service worker definitely downloads remote configuration and uses it to configure requests and features. The inspected evidence does not establish that the server supplies executable code or arbitrary commands rather than data and settings.
A POST request retrieves a remote response as text from the configured remote-config URL. — static/background/index.js:86
The background API client consumes application configuration for request behavior. — static/background/index.js:37
The manifest contains no explicit remote-code permission or externally hosted script declaration. — manifest.json:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension can create or manage Instagram tabs and initiate downloads through extension APIs. The code proves capability and feature-triggered use, but does not prove that these actions occur without any user or feature request.
The extension declares downloads permission and a popup/options UI. — manifest.json:1
The options bundle contains tab-opening behavior. — options.95eda3f3.js:1
The background bundle contains tab coordination and chrome.downloads.download handling. — static/background/index.js:86
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because core runtime files are very large generated bundles, and some configuration is obtained remotely. This limits reliable manual review of all behavior.
The service-worker bundle is approximately 3.6 MB and largely represented as minified generated code. — static/background/index.js:1
The Instagram overlay bundle is approximately 4.2 MB. — instagram-overlay.4dd15585.js:1
The user-notice bundle is approximately 3.4 MB. — instagram-user-notice.89cefbda.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No confirmed use of eval(), new Function(), or string-based timers was established in the readable code. Because large bundles contain minified third-party code and were not fully semantically reviewed, absence of all such use is not proven.
The readable request-instrumentation code uses direct function references and does not show text-to-code execution. — assets/story-identity-main.js:159-187
The generated bundle contains a Function-related capability check, but the cited occurrence does not establish execution of extension-supplied text. — instagram-overlay.4dd15585.js:1
Does it track the websites, pages, searches, or links you visit?
The extension observes selected Instagram requests and extracts Story-related identifiers, but the available evidence does not fully prove that all such observations are persisted or transmitted as tracking data. It is not shown to monitor every website.
The page script filters Instagram Story/GraphQL responses and extracts usernames, user IDs, and Story IDs. — assets/story-identity-main.js:132-187
The background bundle contains Instagram request interception and activity-related handling. — static/background/index.js:86
Content scripts are restricted to Instagram and igmate.net/igmate.me host patterns. — manifest.json:25-50
Does it create a persistent ID or browser fingerprint to recognize you?
The extension creates persistent anonymous and session identifiers and stores identity state. These identifiers can distinguish extension installations or sessions, although the evidence does not establish a full device fingerprint.
The options bundle creates an anonymousId with crypto.randomUUID() and stores identity data. — options.95eda3f3.js:299
The bundle creates a behavior session identifier. — options.95eda3f3.js:272
Account request data includes browser information such as navigator.userAgent. — static/background/index.js:37
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension reads Instagram cookies and authentication-related request metadata and keeps a session snapshot for its features. The reviewed evidence does not establish that raw cookies, session tokens, or page contents are sent to a third party.
The service worker reads Instagram cookies and maintains session state. — static/background/index.js:37
Instagram request headers are inspected and session metadata is updated. — static/background/index.js:86
The API client performs outbound requests, but the cited evidence does not show raw cookie values in their payloads. — static/background/index.js:37
Does it record typing, form entries, clipboard contents, or screenshots?
No runtime code was found that records keystrokes, form entries, clipboard contents, or screenshots. Clipboard references appear to be UI/library support or explicit copy-to-clipboard functionality rather than collection.
Clipboard-related matches are React event-property handling and bundled UI/library code; no clipboard-read collector was identified. — instagram-overlay.4dd15585.js:1,365
Uses navigator.clipboard.writeText to copy an order reference, not to read user clipboard data. — options.95eda3f3.js:272
Can a website or remote server send commands that make the extension take actions?
The service worker accepts runtime messages for privileged extension operations, so extension components can request actions. The evidence does not show that a remote server directly sends arbitrary commands to the worker, nor that every webpage can invoke these handlers.
The background bundle registers chrome.runtime.onMessage and dispatches named operations. — static/background/index.js:1
Remote configuration is fetched, but the cited code does not establish that it is interpreted as commands. — static/background/index.js:86
Only listed content-script host patterns receive extension content scripts. — manifest.json:25-50
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The extension modifies Instagram pages to add downloader features, but the available minified source does not establish alteration of referral codes, advertisements, carts, or search results. Broad page UI code leaves incomplete coverage.
Injects overlay and notice content scripts on all Instagram pages. — manifest.json:25-50
Large generated overlay bundle contains page UI and download logic; exact link-related behavior cannot be fully verified from the minified bundle. — instagram-overlay.4dd15585.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension observes selected Instagram requests and can initiate downloads. The evidence does not show proxy changes or rewriting of requests, and observing headers is different from modifying them.
The service worker registers Instagram request listeners for request headers and GraphQL-related requests. — static/background/index.js:86
The extension declares webRequest and downloads permissions. — manifest.json:1
The background bundle calls chrome.downloads.download. — static/background/index.js:86
Can it communicate with software on the computer or services running on localhost?
No localhost connections, native-messaging calls, or other direct communication with computer software were found. The extension communicates with browser APIs and remote web services instead.
Reviewed the background service's visible networking and messaging paths; no localhost or native-messaging endpoint was identified. — static/background/index.js:1-86
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The package includes large generated bundles and a web-accessible JavaScript resource, but no complete path was established from hidden encoded data through decoding to executable or injected code. The possibility remains unresolved because the bundles are difficult to audit.
The readable script patches XMLHttpRequest.send for request instrumentation, but this is not hidden-data execution. — assets/story-identity-main.js:176-177
The generated bundle contains parsing and dynamic module infrastructure, without a confirmed decode-to-code sink in the inspected evidence. — instagram-overlay.4dd15585.js:1-64
A JavaScript resource is web-accessible to Instagram pages, but exposure alone does not prove privileged execution or hidden-data unpacking. — manifest.json:51-74
Can ordinary websites access privileged extension features through messaging or exposed files?
Instagram pages can load a web-accessible script and matching content scripts can communicate with the extension worker. However, web accessibility alone does not grant privileged APIs, and the evidence does not fully prove that an arbitrary ordinary webpage can invoke privileged handlers without sender validation.
Content scripts are injected only into Instagram and igmate.net/igmate.me matches. — manifest.json:25-50
The story-identity script is web-accessible to matching Instagram pages. — manifest.json:51-74
The worker registers runtime message handlers for named operations. — static/background/index.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Several behaviors are conditional on host, request type, account/session state, feature flow, and remote configuration. Instagram request capture is restricted to matching Instagram traffic rather than running indiscriminately on every site.
Content scripts are restricted to Instagram and igmate.net/igmate.me hosts. — manifest.json:25-50
Request listeners filter Instagram XMLHttpRequests and GraphQL-related URLs. — static/background/index.js:86
Remote configuration is loaded and can affect runtime configuration. — static/background/index.js:86
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining code or other deliberately hidden intensive background computation was identified. Downloading and processing Instagram media can use resources when the user invokes those features.
Observed background work concerns configuration, session tracking, request inspection, and downloads rather than mining. — static/background/index.js:86
Media download and file-processing utilities are present, but no mining behavior was identified. — instagram-overlay.4dd15585.js:1-64
Does it change form fields or where a form sends its information?
The reviewed code shows downloader UI and page overlays but no demonstrated rewriting of form fields or form destinations. The large generated page bundle leaves some uncertainty about unobserved UI paths.
Injected scripts target Instagram pages for overlay and notices. — manifest.json:25-50
Visible code concerns media fetching, file handling, and download UI; no form-action rewriting was identified. — instagram-overlay.4dd15585.js:1-64