Demon Lady Red Sun Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What this extension is

Demon Lady Red Sun Live Wallpaper, version 1.1.2, is published on the Chrome store under [email protected] and has 14 users. The manifest declares no permissions and no host permissions. That detail outweighs everything else here: without tabs, cookies, history or scripting access, the extension has no standard route to the pages a person visits or the sessions they hold.

The six network findings

The only medium-severity items are request sites across four scripts: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Six fetch calls spread across a background worker, a popup, a side panel and a weather script is the shape of a wallpaper app pulling images and refreshing a forecast. The hosts that resolve to anything real support that reading: api.gameograf.com and gameograf.com belong to the publisher, and www.blogger.com, youtube.com and chat.openai.com are ordinary content and assistant endpoints. None is a search-hijack template, an exit node or a known credential-harvesting host.

Most of the endpoint list is not a list of endpoints

Roughly a dozen recorded strings cannot be hosts at all. sidepanel.open and sidepaneltoggle.is are Chrome side panel API property chains glued together with the .is country code. uł.nz, ɳua.sb, bg.mp, c0.de, ke.td, td.et, e7za.tl and ce.support are short fragments cut from minified or localized JavaScript. The rest of the volume is 50 IoC matches and 45 low-severity code-smell items, all pattern hits on ordinary JavaScript. That total describes the scanner's behaviour, not the extension's.

The counterargument

A skeptic has two fair points. The publisher field is an email address rather than a company name, and 14 users is no track record. chat.openai.com also stands out for a wallpaper product, though a side panel script calling an assistant endpoint is a plausible feature, and a request to a public chat domain carries no page data while the extension cannot read pages. The second point is stronger: a live wallpaper product needs a new tab override, and manifest analysis returned no findings at all, so how that override is wired stays unconfirmed. That is a gap to close with a manifest pass, not evidence of harm.

Why this reading holds

No malware signature matched. No obfuscation was detected. There are no secrets, no bundled dependencies and no tool-poisoning signals. Removing the extractor noise leaves a UI that makes six web requests, four of them in scripts whose names describe the feature they serve. A malicious extension at this capability level would need page access it never requested. The open item is the new tab override, and a second pass over the manifest is what would settle it.

Key Reasons

• Manifest declares no permissions and no host permissions, so the extension cannot read page content, cookies or history through the standard permission model
• The only medium-severity findings are six fetch call sites in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, all consistent with loading wallpaper and weather content
• No malware signatures, no obfuscation, no secrets, no dependencies and no tool-poisoning findings
• Endpoints that look alarming (sidepanel.open, sidepaneltoggle.is, uł.nz, ɳua.sb, td.et, c0.de) are API property chains and minified-JS fragments misread as domains
• Publisher's own api.gameograf.com and gameograf.com account for the real network destinations

False Positive Considerations

• XIOC extractor fragments misread as domains: sidepanel.open, sidepaneltoggle.is, uł.nz, ɳua.sb, td.et, c0.de, e7za.tl
• 45 low-severity code-smell rule matches on ordinary extension JavaScript
• Legitimate fetch calls in js/background.js and js/weather.js counted as network risk for a wallpaper app
• Publisher-owned api.gameograf.com and common content hosts counted toward endpoint volume

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 80%.