Ryomen Sukuna Eternal Curse Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Ryomen Sukuna Eternal Curse Live Wallpaper swaps Chrome's new tab page for an animated video background. The manifest declares no permissions and no host permissions at all. For a new tab extension that is normal, since chrome_url_overrides.newtab needs no permission, and it caps what the code can reach: no history, no cookies, no bookmarks, and no cross-origin reads beyond what a server chooses to allow.

The six network findings are plain fetch calls: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Fetching is how this kind of extension loads its video asset and the small weather module that the presence of js/weather.js implies. Nothing in the findings pairs those calls with a host permission, an exfiltration-shaped payload or a hardcoded suspicious host. No malware signature matched anywhere in the package, and no obfuscation finding fired.

The 498 IoC entries supply almost all of the alarming volume, and they do not hold up. The endpoint list runs 0aehqf.gy, 0uh.va, 0v.yt, 0z.re, 1e.sm, 2i4.mx, 3qa.ar, 3r.ec, 4i.ad, 5o.ne and similar. These are two and three character strings with country-code suffixes, the exact shape produced when a scanner scrapes minified JavaScript for anything domain-like. A new tab wallpaper has no plausible reason to contact 4g0.ac or 5k.cd, and nothing in the extension's behaviour corroborates that it does.

The 44 code-smell findings are all low severity. Rules in that family match ordinary JavaScript: string building that resembles a query, weak random calls, variable names containing key or token. They fire on most non-trivial bundles and describe code quality, not intent.

A skeptic would push back on one point. A live wallpaper that also ships js/weather.js and a side panel is doing more than showing an image, and six fetch sites across four scripts is a lot of outbound code for a theme. If runtime traffic showed those calls landing on an ad or analytics network, the read would change. What the manifest shows is an extension that requested no host access, so any such call is limited to servers that permit it. The missing piece is the actual fetch URLs, which the findings do not capture. Capture those and the question closes.

At 46 users on version 1.1.2 from a developer contact at gameograf.com, the evidence describes a straightforward themed new tab page with a weather widget. The scanner tripped on minified string fragments and generic code-quality rules.

Key Reasons

• No malware signatures, no obfuscation and no tool-poisoning findings across 548 total
• Manifest declares zero permissions and zero host permissions
• Network findings are plain fetch calls in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js
• Reported endpoints such as 0aehqf.gy, 0v.yt and 2i4.mx are two-to-three character minified-JS fragments, not real destinations
• No impersonation: distinct themed name with a developer contact at gameograf.com

False Positive Considerations

• 498 IoC entries are minified-JS string fragments (0v.yt, 3qa.ar, 5k.cd) rather than real endpoints
• All 44 code-smell findings are low severity generic JavaScript rules
• Six network findings are ordinary fetch calls in wallpaper and weather scripts
• Manifest requests no permissions and no host permissions

Reviewed 2026-10-14; recommended action: suppress false positive; model confidence 82%.