Is InLoad - App Client for Instagram safe?
We analyzed InLoad - App Client for Instagram version 1.0.7's actual code and gave it a 65/100 trust score. This is a useful but broadly empowered…
Bottom line
This is a useful but broadly empowered Instagram helper with no established data theft or remote-control behavior.
What it can access
It can inspect pages broadly and download media, capture the visible tab, and alter Instagram traffic, although these features are mainly Instagram-focused. [Q1][Q2][Q5][Q18]
Security weaknesses
Broad all-site access and an all-site link handler can affect unrelated pages, while header changes and navigation interception add avoidable power. [Q1][Q17][Q18]
Signs of misuse
No evidence shows data being sent elsewhere, remote commands, automatic sensitive actions, credential collection, or downloaded code execution. [Q6][Q7][Q8][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has all-website access, downloads, visible-tab capture capability, request-header rules, display information, and local storage. Most features target Instagram, but a link helper runs on every site and frame.
Declares Instagram scripts, an all-URLs/all-frames link script, all host access, downloads, display, storage, and declarativeNetRequest. — manifest.json:27-66
Which websites can it run on, and can it read or change what appears on those pages?
On Instagram it scans images and videos for media source URLs and adds controls. On all other sites it scans only anchor hrefs containing instagram.com.
Searches Instagram media DOM and derives src/srcset/currentSrc values. — data/content.js:1
Observes page mutations and queries only Instagram links. — data/listenerLink.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Uses navigation controls and media elements rather than form or message text. — data/content.js:1
Reads only clicked Instagram-link hrefs. — data/listenerLink.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores theme, rating-prompt, and local click-count state. It does not access browser cookies, history, bookmarks, or saved passwords.
Stores theme state and a local interaction counter. — data/content.js:1
Stores whether the rating action was clicked. — data/rate.js:1
Requests storage but not cookies or history. — manifest.json:52-58
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can download selected Instagram media and capture the entire visible tab as a PNG. Screenshot content may include sensitive information visible in the tab, but capture requires the extension's button.
Sends downloadImg and takeScreenshot only from injected control click handlers. — data/content.js:1
Uses downloads.download and captureVisibleTab, then downloads the result. — worker.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Uses provided media URLs only as Chrome download sources and contains no custom reporting request. — worker.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Defines fixed download, screenshot, window, and User-Agent behavior locally. — worker.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Sensitive actions are attached to extension-control clicks. — data/content.js:1
Header-rule changes follow window-focus events rather than collecting data. — worker.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings or override capability. — manifest.json:1-69
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party files are minified to single lines, reducing reviewability, but their logic remains structurally readable. Minification alone is not evidence of abuse.
Contains minified but named class methods for each feature. — worker.js:1
Contains minified Instagram UI and media logic. — data/content.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses fixed callbacks and Chrome APIs without text-to-code execution. — worker.js:1
Uses packaged code and fixed intervals only. — data/content.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Checks window.location.href and pathname for Instagram page types. — data/content.js:1
Reads href only after a matching Instagram link is clicked. — data/listenerLink.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Maintains a local interaction count only to show a rating prompt. — data/content.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission. — manifest.json:52-58
Changes only the User-Agent header and never reads credentials. — worker.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture the visible tab, but only after the user clicks its screenshot control. No keystroke or form monitoring was found.
The icon-screen click sends takeScreenshot. — data/content.js:1
Captures and downloads the visible tab as the requested format. — worker.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Accepts only fixed runtime actions from extension contexts. — worker.js:1
Sends those actions from extension-added click handlers. — data/content.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It adds navigation, theme, screenshot, and media-download controls to Instagram. The all-sites helper also prevents default navigation on clicked Instagram links, although its background action has no matching handler in this package.
Injects Instagram controls and download buttons. — data/content.js:1
Calls preventDefault and sends open_insta_link for clicked Instagram anchors. — data/listenerLink.js:1
Defines no open_insta_link action handler. — worker.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It downloads media and screenshots and changes the User-Agent header on Instagram traffic to mimic an iPhone while a narrow window is focused. It does not intercept response bodies or redirect requests.
Uses downloads, captureVisibleTab, and a session declarativeNetRequest modifyHeaders rule limited to instagram.com. — worker.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:52-58
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Passes media URLs to the browser download API without evaluating their content. — worker.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Sends runtime messages only from handlers attached to extension-added controls. — data/content.js:1
Does not forward window messages or arbitrary page data. — data/listenerLink.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Adds or removes the Instagram User-Agent rule based on focused-window width. — worker.js:1
Stores and applies the local theme setting. — data/content.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Uses intervals for Instagram DOM controls and media discovery, not computational mining. — data/content.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Targets navigation buttons and image/video elements rather than forms or inputs. — data/content.js:1