Yomu Yakadashi Art Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Yomu Yakadashi Art Live Wallpaper extension exhibits classic XIOC extractor false-positive patterns with no actual malicious indicators. All 165 IoC findings are property access chains misidentified as domains: this.map, t.events, r.old.call, e.elem.style, v.data, and l.opts.fail are JavaScript object property accesses, not network destinations. This matches the documented false-positive pattern where chains like b.call, h.next, g.id are incorrectly flagged as domains.

Critically, the extension has zero malware signatures, zero malware findings, and zero obfuscation findings. The 21 code-smell findings are low-severity noise (per guidelines, code-smell findings should never drive a verdict). The 2 network findings are not detailed in the bundle but are too few to indicate data exfiltration without specific suspicious domains.

The extension's stated purpose (live wallpaper for manga/anime art) is benign and consistent with its category. While the developer is anonymous (email [email protected] rather than a company name) and user count is low (34 users), these are not threat indicators when no malicious code is present. The high version number (4.60) suggests ongoing development, which could indicate either legitimate updates or attempts to evade detection—but without malware signatures or obfuscation, the latter is unsupported.

Strongest counterargument: A skeptic could argue that 188 total findings with an anonymous developer warrants caution. However, the finding count is entirely driven by XIOC garbage (165 of 188 findings), which the guidelines explicitly state is meaningless. The developer being anonymous does not constitute malicious intent when the code contains no malware signatures, no obfuscation, and no suspicious network behavior. If this were actual malware, we would expect to see at least one malware signature, obfuscation, or a specific suspicious domain—not 165 property-access false positives. The verdict remains likely_false_positive because the evidence quality for actual threat is absent, and all findings match known false-positive patterns.

Key Reasons

• All 165 IoC findings are property access chains (this.map, t.events, e.elem.style), not real domains
• Zero malware signatures or malware findings detected
• Zero obfuscation findings
• Code-smell findings are documented noise sources

False Positive Considerations

• XIOC property access chain misidentification
• Code-smell rules firing on benign patterns
• Minified JavaScript triggering false domain detection

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 85%.