Red Goku Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

Security Analysis: Red Goku Live Wallpaper

This extension has been flagged with 247 total findings, but the nature of these findings indicates a systematic false positive rather than actual malicious behavior.

IoC Findings Analysis

All 224 IoC findings are false positives from the XIOC extractor. The findings include entries like XIOC-DOMAIN-ce.event.handlers.call, XIOC-DOMAIN-u.data, XIOC-DOMAIN-e.target, XIOC-DOMAIN-t.click, and XIOC-DOMAIN-this.target. These are not actual domain names but JavaScript property access chains being misidentified. For example, e.target is a standard DOM event handler pattern, t.click is an event listener reference, and ce.event.handlers.call is object property access. None of these represent network connections to external domains. This is a well-documented false positive pattern where the XIOC extractor misreads property access chains like b.call, h.next, and g.id as domain names.

Malware and Obfuscation

The extension has zero malware signatures, zero obfuscation findings, and zero tool-poisoning indicators. This is a strong signal that the code is not attempting to hide malicious behavior. The 21 code-smell findings are classified as low severity and match expected patterns for JavaScript extensions (per the CVEQ false positive documentation, code-smell findings should be treated as noise).

Extension Purpose

The extension's description states "Unleash the power of Red Goku every time you open a new tab!" which aligns with a legitimate wallpaper/new tab customization tool. The name "Red Goku Live Wallpaper" is descriptive of anime-themed content, not an attempt to impersonate a known extension. The developer identifier "[email protected]" is an email address rather than a company name, which is common for small indie creators.

Counterargument

A skeptic might point to the 21 high-severity and 226 medium-severity findings as evidence of risk. However, these severity classifications are driven entirely by the false positive IoC patterns, not by actual malicious behavior. The severity scoring system has known biases where finding counts inflate scores regardless of finding nature. The absence of malware signatures, obfuscation, and real suspicious domains is the more reliable indicator. The 2 network findings are minimal and do not point to credential theft, data exfiltration, or browser hijacking.

Conclusion

This extension represents a clear false positive case where the XIOC extractor's garbage patterns have generated hundreds of non-actionable findings. The actual code shows no evidence of malicious behavior, credential theft, browser hijacking, or data exfiltration. The extension should be reclassified to reflect that the findings are systematic false positives from the IoC extractor, not indicators of actual security risk.

Key Reasons

• All IoC findings are JavaScript property access chains, not real domains
• Zero malware signatures detected
• Zero obfuscation detected
• Extension functionality matches its description (wallpaper/new tab)
• No suspicious external domains in findings

False Positive Considerations

• XIOC-DOMAIN false positives (property access chains misidentified as domains)
• Code-smell findings (low severity, expected noise per CVEQ documentation)
• High finding count from bundled code patterns
• Severity scoring inflation from IoC volume

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 85%.