Lamine Yamal Live Wallpaper

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

This extension claims to provide a "Live Wallpaper" for football player Lamine Yamal, but the evidence reveals browser hijacking behavior. The description explicitly mentions "powers your new tab"—a common indicator of new tab page replacement, which is the primary vector for browser hijacking. The developer is listed as [email protected], an anonymous Gmail address with no company attribution, which is a red flag for extensions claiming legitimate functionality.

The most concerning evidence is the 453 IoC findings, predominantly short URL domains including b.tn, bğ.sk, v.pe, ޡ.ua, zy.su, s.mv, d.cr, t.ec, y.ws, ta.mg, n.tv, and 7.mq. These are not legitimate content delivery domains—they are URL shortener services commonly exploited by adware to redirect user traffic through monetization schemes. The sheer volume of these domains suggests the extension embeds redirect chains rather than actual wallpaper assets. For a wallpaper extension, there is no legitimate reason to include hundreds of short URL domains.

The version number 9.9.9 is suspiciously high for what appears to be a recently published extension, suggesting version inflation to appear established. With 1,000 users, this extension has already impacted a notable audience. The 16 code-smell findings are low-severity and expected in any non-trivial JavaScript code; they do not indicate malicious behavior on their own.

Counterargument: A skeptic might argue that the high IoC count could be false positives from bundled dependencies or that short URLs could serve legitimate purposes. However, the evidence shows zero malware signatures, zero obfuscation, and zero network findings—the IoCs are static domain strings extracted from files. More importantly, the nature of these domains (URL shorteners) combined with the "new tab" functionality and anonymous developer creates a coherent browser hijacking profile. Bundled dependencies would produce CDN domains like googleapis.com or gstatic.com, not a concentrated list of redirect services. The mismatch between the claimed wallpaper functionality and the actual domain patterns is the smoking gun.

This extension should be flagged as a browser hijacker that likely replaces the new tab page with monetized content routed through redirect domains.

Key Reasons

• 453 short URL domains (b.tn, v.pe, d.cr, etc.) indicate redirect-based monetization
• Anonymous Gmail developer with no company attribution
• New tab functionality inconsistent with wallpaper extension claims
• Suspiciously high version number 9.9.9 for new extension
• No malware signatures or obfuscation but clear hijacking pattern

False Positive Considerations

• Code-smell findings (16) are expected in any JavaScript code
• No bundled dependency domains in IoC list

Reviewed 2026-05-10; recommended action: monitor; model confidence 75%.