Hokage Naruto Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension, "Hokage Naruto Live Wallpaper" by [email protected], exhibits a classic false-positive profile. The 437 IoC findings (XIOC-DOMAIN-ke.va, XIOC-DOMAIN-y.bt, XIOC-DOMAIN-9.gw, XIOC-DOMAIN-wr.tc, XIOC-DOMAIN-h.bs, XIOC-DOMAIN-fo.ml, XIOC-DOMAIN-i.ss, XIOC-DOMAIN-ψ.sd, XIOC-DOMAIN-d.pg, XIOC-DOMAIN-3.mc) all share identical characteristics: single-character or 2-3 character subdomains on unusual TLDs, all marked as "extracted_from_files" rather than specific source files. This pattern matches the documented XIOC extractor garbage profile where property access chains like "b.call", "h.next", "g.id" are misread as domain names. The sheer volume of 437 IoCs with zero malware signatures and zero obfuscation findings is a strong indicator of extraction noise rather than malicious behavior.

The network findings (NET-FETCH-js/popup.js-35 and NET-FETCH-js/script.js-17) are generic fetch calls without suspicious destination domains. For a live wallpaper extension, network activity is expected behavior to load or update wallpaper content. The code-smell findings (23 total) are classified as low severity and match the documented noise patterns for basic JavaScript patterns.

The extension's purpose aligns with its behavior: a live wallpaper extension requires network access to load animated content. The developer attribution ([email protected]) is present rather than anonymous. Zero malware signatures across 462 total findings is definitive evidence against malicious intent—if this were credential theft, browser hijacking, or malware delivery, at least some malware-family YARA rules would trigger.

The strongest counterargument is the high finding count of 462 total findings. However, finding COUNT is explicitly documented as meaningless in the CVEQ threat model. The NATURE of findings matters: all 437 IoCs are garbage patterns, the 2 network findings are generic fetch calls, and the 23 code-smell findings are low-severity noise. No specific suspicious domains (like query., search., or credential-targeting domains) appear in the evidence. The extension has no obfuscation, no malware signatures, and no impersonation indicators. This is a textbook false-positive case where the XIOC extractor's domain extraction produced hundreds of false positives from minified JavaScript property access chains.

Key Reasons

• 437 IoC findings match known XIOC extractor garbage pattern (short property chains misread as domains)
• Zero malware signatures across 462 total findings
• Zero obfuscation findings
• Network findings are generic fetch calls consistent with wallpaper extension behavior
• Developer attribution present ([email protected])

False Positive Considerations

• XIOC extractor property access chain garbage
• Code-smell rules firing on basic JavaScript patterns
• High finding count from bundled/minified code

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 85%.