Cinnamoroll Space Adventure Pastel Live Wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

Extension Overview

"Cinnamoroll Space Adventure Pastel Live Wallpaper" is a Chrome extension from developer [email protected] with 707 users. The extension claims to provide space-themed live wallpaper functionality.

Key Findings Analysis

The evidence shows 363 total findings, but the nature of these findings is critical. Zero malware signatures were detected, and zero obfuscation findings exist. The 346 IoC findings are overwhelmingly false positives from known CVEQ noise patterns.

The XIOC extractor flagged domains like trigger.click, toggle.click, r.open, and custom.click - these are clearly JavaScript property access chains being misread as domains, not actual network destinations. Similarly, bg.mp is likely a filename fragment (background.mp) misidentified as a domain. The Adobe XMP namespace URLs (http://ns.adobe.com/xap/1.0/, http://ns.adobe.com/xap/1.0/rights/) and W3C RDF namespace (http://www.w3.org/1999/02/22-rdf-syntax-ns#) are metadata standards embedded in assets, not active network requests.

The Real Concern

One finding stands out: https://gameograf.com/?utm_source=ovkas&utm_medium=ovkas&utm_campaign=ovkas&utm_content=ovkas extracted from files. Gameograf is a game download/affiliate site. This domain appears twice in the IoC findings with UTM tracking parameters, indicating intentional marketing integration. For a live wallpaper extension, embedding a game download site with affiliate tracking is inconsistent with the stated functionality and suggests adware behavior or revenue generation through game promotion.

Counterargument

A skeptic might argue the gameograf.com URL could be from a bundled third-party library or accidental inclusion in assets. However, the presence of UTM campaign parameters (utm_source=ovkas, utm_campaign=ovkas) indicates deliberate tracking integration, not accidental asset inclusion. The extension's description makes no mention of game features, making this domain's presence genuinely suspicious for its stated purpose.

Conclusion

While most findings are false positives, the gameograf.com domain represents a legitimate adware concern for an extension claiming to be a simple wallpaper tool.

Key Reasons

• Game download domain (gameograf.com) with UTM tracking embedded in wallpaper extension
• No malware signatures detected
• 346 of 363 findings are false positives from known XIOC noise patterns
• Anonymous developer (email-only attribution)
• Extension functionality inconsistent with embedded game promotion domain

False Positive Considerations

• XIOC property access chain misidentification (trigger.click, toggle.click, r.open)
• Adobe XMP namespace metadata URLs
• W3C RDF namespace metadata URLs
• Code-smell findings from basic JavaScript patterns

Reviewed 2026-05-09; recommended action: escalate; model confidence 75%.