Jinx Arcane LoL Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The store listing promises a live HD video wallpaper of Jinx on the new tab page, plus a side panel and a weather widget. Version 1.4, published under [email protected], 109 users on the Chrome Web Store. Nothing in the scan contradicts that description: the extension declares no permissions and no host permissions, which is what a new tab override needs when it only loads its own artwork and a weather feed.

The medium-severity findings are six fetch calls: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Those file names line up with the advertised features. background.js loads the wallpaper assets, popup.js and sidePanel.js populate the two UI surfaces, weather.js retrieves forecast data. The scan extracted no network endpoints and no indicators of compromise from any of them, so there is no domain to weigh as suspicious, only the fact that the extension talks to the network at all.

The remaining 44 findings are low-severity code-smell results. These rules match generic JavaScript: bundler wrappers, crypto imports, environment variable reads, string handling patterns. They carry no descriptions and no file context. Across CVEQ scans they fire on essentially every extension shipping minified JavaScript, and they are excluded from verdicts for that reason. Alongside them: zero malware signatures, zero obfuscation findings, zero secrets, zero suspicious dependency matches, zero manifest issues. A bundle where the only signals are code-smell rules and ordinary fetch calls is the shape of a normal extension with a normal build pipeline.

The strongest counterargument is category risk. Live wallpaper extensions that take over the new tab are a common vehicle for browser hijacking and ad injection, and the publisher here is a bare email address rather than a verified brand, with 109 users providing no reputation to lean on. The scan also does not show the destinations of those six fetches, so we cannot see whether background.js talks to a wallpaper CDN or to a tracker. That is a real gap. What the hijack playbook leaves behind, though, is specific and absent here: a custom search host, a query template rewritten at runtime, cookie access paired with external transmission, or a new tab page redirecting to a monetized portal. None of those appear in any file. When a scanner returns 50 findings on an extension with no malware signature, no suspicious domain and no obfuscation, the volume is coming from rule breadth, not from behavior. The six fetch calls are the extension doing what it says it does.

Key Reasons

• All 44 low-severity findings are code-smell rules that match generic JavaScript and carry no descriptions or file context, the documented noise class in CVEQ scans.
• The six medium findings are plain fetch calls in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, matching the wallpaper, popup, panel and weather features named in the description.
• Zero malware signatures, zero IoCs, zero obfuscation findings, zero secrets and zero suspicious dependencies in a 50-finding scan.
• No declared permissions and no host permissions, consistent with a new tab override that only loads its own media and a weather feed.
• No hijack signals: no custom search host, no runtime query template, no cookie access paired with external transmission.

False Positive Considerations

• 44 low-severity code-smell matches that fire on any non-trivial bundled JavaScript and are excluded from verdicts.
• Finding count inflated by rule breadth rather than behavior: 50 findings with no malware signature, no IoC and no obfuscation.
• Network findings are bare fetch calls with no extracted endpoints, so they carry no reputation data and cannot be scored as suspicious domains.
• Minified wallpaper and UI scripts that trigger generic code-quality rules by construction.

Reviewed 2026-10-15; recommended action: suppress false positive; model confidence 72%.