Sad Knight 4K Live Wallpaper New Tab

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension, "Sad Knight 4K Live Wallpaper New Tab" by developer [email protected], presents 408 total findings but lacks any substantive threat indicators. The 392 IoC findings (all medium severity) consist of domain detections like XIOC-DOMAIN-e.uz, XIOC-DOMAIN-j2d.lr, XIOC-DOMAIN-g.hm, and XIOC-DOMAIN-k.no. These domains follow a pattern consistent with XIOC extractor false positives: short, country-code TLD domains that often result from property access chains in minified JavaScript being misread as domain strings. Crucially, there are zero network findings, which means the static analysis did not detect any actual network communication to these domains. If these were genuinely contacted domains, the network category would show findings.

The 16 code-smell findings are classified as low-severity and match known false-positive patterns: generic JavaScript patterns like fetch, crypto, or environment variable references that fire on almost any non-trivial code. There are zero malware signatures, zero malware findings, zero obfuscation findings, and zero secret findings. The extension's stated purpose—a live wallpaper with clock and Google search bar for a new tab page—aligns with typical benign new tab replacement extensions.

The developer uses a personal Gmail account rather than a verified company name, which is a minor red flag but not determinative. Extensions with 1,000 users and this finding profile commonly represent false positives from automated extraction tools rather than actual threats.

A skeptic might argue that the 392 IoC findings and odd domain patterns (e.uz, j2d.lr, fda7.rs) warrant concern. However, the absence of network findings is decisive: static domain strings in code are not threats unless they are actively contacted. The XIOC extractor is documented to produce massive false-positive volumes from property access chains and minified code. Without network evidence, malware signatures, or obfuscation, these IoCs represent noise from the extraction pipeline, not malicious behavior. The extension's behavior matches its description, and no capability for data exfiltration, credential theft, or browser hijacking is evidenced.

Key Reasons

• Zero malware signatures and zero malware findings despite 408 total findings
• Zero network findings indicate IoC domains are not actively contacted
• Zero obfuscation findings rules out hidden payload delivery
• IoC pattern matches known XIOC extractor false-positive behavior
• Extension behavior aligns with stated purpose (new tab wallpaper)

False Positive Considerations

• XIOC domain extraction false positives from property access chains
• Code-smell findings from generic JavaScript patterns
• High finding count from bundled/minified code
• Score inflation from IoC volume rather than finding nature

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 75%.