Hatsune Miku China Dress Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension presents a textbook false-positive pattern driven by the XIOC extractor's documented tendency to misidentify JavaScript property access chains as domain indicators. All 201 IoC findings follow this exact pattern: v.beforesend.call, t.using.call, r.open, t.name, xt.host, and s.data are not real domains but rather minified variable.property.method chains that the extractor incorrectly parsed as network indicators. These match the documented false-positive pattern described as "Property access chains misread as domains: b.call, h.next, g.id."

The findings summary shows zero malware signatures, zero obfuscation findings, and zero actual network findings. The 16 code-smell findings (categorized as "high" severity) are typical of the YARA rules that fire on basic JavaScript patterns like fetch, exec, or crypto references—these are documented noise sources that should not drive verdicts. The extension's stated purpose as a "Hatsune Miku China Dress Live Wallpaper" is a legitimate browser customization category. There is no evidence of behavior mismatch: the findings do not indicate credential theft, browser hijacking, proxyware, or malware delivery.

The developer attribution uses an email address ([email protected]) rather than a company name, which is slightly unusual but not definitively suspicious for a small developer creating fan content. The user count of 196 is low, suggesting this is a niche extension rather than a mass-distribution malware campaign.

A skeptic might argue that 217 total findings with 201 IoCs represents significant risk. However, finding volume is explicitly called out as a known false-positive driver in CVEQ's documentation. The scoring system has documented bias where IoC volume disproportionately inflates scores, with confirmed false positives averaging risk scores of 83.2. What matters is the nature of findings, not the count: zero malware signatures, zero obfuscation, and zero actual network traffic findings are strong indicators of benign behavior. The IoC findings are all categorized as "medium" severity but represent the exact garbage pattern described in the XIOC extractor documentation.

The evidence strongly supports classifying this as a false positive. The extension should be reanalyzed with IoC filtering to confirm the benign nature of the code, or the false positive drivers should be suppressed in the scoring system.

Key Reasons

• All 201 IoC findings are property access chains, not real domains
• Zero malware signatures detected
• Zero obfuscation findings
• Zero actual network traffic findings
• Legitimate live wallpaper extension category

False Positive Considerations

• XIOC property access chain misidentification
• Code-smell YARA rules on benign JavaScript
• No malware signatures or obfuscation
• Legitimate extension category (live wallpaper)

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 85%.