Is FastSave & Repost for Instagram safe?
We analyzed FastSave & Repost for Instagram version 4.8.0's actual code and gave it a 58/100 trust score. This extension can support Instagram saving and…
Bottom line
This extension can support Instagram saving and reposting, but its broad access, cookie handling, and automatic third-party contacts warrant caution.
What it can access
It runs across all websites and requests cookies, downloads, tabs, and request-control powers, while demonstrated use focuses mainly on Instagram media.[Q1][Q2][Q14][Q18]
Security weaknesses
An origin-unchecked message bridge on three sites can change a local tour flag, and the extension can alter request headers for mobile mode.[Q21][Q18]
Signs of misuse
It sends selected Instagram links to a third-party download site and contacts outside services automatically when installed.[Q6][Q8]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access to every site plus cookies, tabs, downloads, request headers, display information, storage, and network-rule changes.
Declares <all_urls> host access and content scripts, cookies, tabs, downloads, webRequest, system.display, and declarativeNetRequest. — manifest.json:14-71
Which websites can it run on, and can it read or change what appears on those pages?
It reads Instagram page structure, links, images, videos, account names, and internal React data to locate downloadable media.
Queries Instagram DOM elements and internal React properties to find post IDs and media URLs. — js/extension.js:2
Runs in Instagram's main world and extracts post identifiers from Instagram DOM and React objects. — js/injectHelper.js:11-38
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It handles user-selected media and captions for reposting, but no password or private-message collection path was found.
Builds a repost preview, reads the caption entered in its own textarea, and uploads the selected media to Instagram after Share is clicked. — js/extension.js:2
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Does not request history, bookmarks, password, or autofill permissions. — manifest.json:25-33
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It downloads media and reads display dimensions; no camera, microphone, clipboard-read, or filesystem-wide access was found.
Uses chrome.downloads.download and chrome.system.display.getInfo for downloads and its mobile popup layout. — js/background.js:2
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A high-resolution download sends the chosen Instagram post URL to fbvideosaver.net; other sensitive requests observed go to Instagram itself.
Builds https://fbvideosaver.net/?url=<selected Instagram URL> only from an Instagram URL allowlist and opens it after the download action. — js/extension.js:2
The popup uses the same allowlisted third-party download URL for the user's selected post. — js/popup.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses packaged constants and locally learned Instagram query hashes; the install-time downloadigs.com request does not consume its response body. — js/background.js:2
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically contacts downloadigs.com and opens fbvideosaver.net on installation, and scans pages for Instagram post links.
The onInstalled handlers fetch downloadigs.com/api and open fbvideosaver.net without a separate in-page action. — js/background.js:2
On page load, observes article links but retains only validated instagram.com post and story URLs. — js/contentScript.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Adds declarativeNetRequest session rules that replace User-Agent, then narrows the rule to the created mobile Instagram tab. — js/background.js:2
Overrides navigator fields to emulate an iPhone. — js/navigator.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Webpack-style minified bundle includes recognizable jQuery, React, browser polyfill, and product code. — js/extension.js:1-2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains packaged jQuery global-evaluation helpers, but no reachable product path feeds remote text into them. — js/extension.js:2
Extension pages use a self-only script policy. — manifest.json:74-75
Does it track the websites, pages, searches, or links you visit?
It sees active-tab URLs and scans page links, but only retains Instagram post and story URLs and does not transmit general browsing history.
Validates discovered links against instagram.com and a narrow post/story path pattern before sending them internally. — js/contentScript.js:1
Reads the active tab URL to report whether Instagram is open and to build user-requested download actions. — js/popup.js:2
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores feature state and Instagram request values, but does not create or transmit a tracking identifier. — js/background.js:2
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads Instagram session cookies and authentication-related request headers, but the demonstrated sinks use them only for Instagram operations initiated through the extension.
Reads all cookies for instagram.com, requires ds_user_id and sessionid, and captures x-ig-www-claim, x-asbd-id, and x-instagram-ajax from Instagram requests. — js/background.js:2
Uses the captured values for user-clicked uploads and configure requests whose destinations are all https://www.instagram.com. — js/extension.js:2
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests no desktopCapture, tabCapture, camera, microphone, or clipboardRead permission. — manifest.json:25-33
Reads only the caption field created by the extension itself for a repost. — js/extension.js:2
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote responses are media or ordinary API responses; the extension does not parse them as commands that choose privileged actions. — js/background.js:2
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates and inserts download/repost buttons and preview modals on Instagram. — js/extension.js:2
Injects the packaged navigator override when mobile mode is used. — js/transform.js:1-5
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It downloads remote media, observes Instagram request headers, and temporarily changes request headers for mobile mode.
Uses downloads, webRequest.onBeforeSendHeaders, and declarativeNetRequest session rules. — js/background.js:2
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does not request nativeMessaging or external application permissions. — manifest.json:25-33
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The install-time downloadigs.com response is ignored; media responses are saved as files or ZIP entries. — js/background.js:2
Remote Instagram responses are treated as JSON or media, not executable code. — js/extension.js:2
Can ordinary websites access privileged extension features through messaging or exposed files?
Pages on three Spector domains can read or set a local tour-completion flag through an origin-unchecked message bridge; no sensitive data or broader privileged action is exposed.
Loads downloaderSiteContent.js only on spector.cx, spector.team, and spector.ac subdomains. — manifest.json:57-64
Accepts GET_IS_TOUR and FINISH_TOUR window messages without checking event.origin or event.source, but only accesses isSiteTour. — js/downloaderSiteContent.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Stored settings track installation, popup state, query hashes, and captured Instagram headers; no remote feature flag selects hidden behavior. — js/background.js:2
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
CPU-heavy work is limited to user-requested ZIP creation for downloaded media. — js/background.js:2
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Adds its own repost textarea and controls on Instagram; no existing page form action or unrelated input value is redirected. — js/extension.js:2