It basically uses the freely available Steam API to send the same command that is sent to the Steam servers when you run a game. It makes it appear that you are actually running the game.

This program is used by thousands of people and not one person has been banned from Steam for using it. What this program does can be done by anybody. Valve has pretty much no way to prevent something like this from being used or even detect that it is being run to possibly ban you.

Just don't run this and play a game on your account at the same time. Using this and playing a VAC enabled game does run the risk of a VAC ban as the VAC system may see IM as a cheat program. Also running two games at the same time does not increase your card drop rates anyway.

Hmm... okay. Why does it want me to sign in to my steam account through this program? Why does it need that info? Surely it can idle for cards without signing into your account, right?

Nope.

It needs access to your library to see what games you own so it can idle for cards.

It is safe and the source code is available to people to look through. If something bad was happening here it would have been detected a LONG time ago and this program would not exist anymore.

The developer of IM gets ZERO personal information from your account. No passwords. No credit card info. Nothing. All the program can see is what the public sees when they look at your profile. They also can not do anything to your account. The login system is the same system that places like Steamgifts.com uses, OpenID.