Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Demon Lady Red Sun Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 1 weeks ago
- Version
- v1.1.2
- Artifact
- SHA256 492…07C
- Source
- Findings (non-IoC)
Is Demon Lady Red Sun Live Wallpaper safe?
Demon Lady Red Sun Live Wallpaper is a new tab wallpaper extension for Chrome, published under the contact address [email protected] and installed by 14 people. It declares no permissions and no host permissions, so it has no standard way to read the pages you visit, your cookies or your saved passwords. The one address it clearly talks to is api.gameograf.com, its publisher's own server, which is what a wallpaper app needs to load artwork and check for updates.
The flagged items are six outbound request points, recorded as NET-FETCH-js/background.js-63, NET-FETCH-js/popup.js-39 and NET-FETCH-js/weather.js-49 among others. If those were shipping your data somewhere unexpected they would matter a great deal. The hosts involved are the developer's own domain, plus blogger.com, youtube.com and chat.openai.com, which reads like ordinary content loading.
Most of the rest of the list is junk produced by the scanner rather than code in the extension. Strings like sidepanel.open and sidepaneltoggle.is are Chrome interface names, not websites. Entries such as uł.nz, ɳua.sb and td.et are short fragments cut out of minified JavaScript. Nothing here matched a malware signature, and nothing is obfuscated.
What would change that reading is a manifest asking for tabs, cookies or history access, or a request going to a host that is not the publisher's own. Neither is present in what we can see. One thing we could not confirm is how the extension takes over the new tab page, since the manifest itself produced no analysis output, and 14 users means there is very little track record to check it against.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall file manipulation | 14 | js/todo.jscss/style.cssjs/chatgpt.js +11 more | - |
| LOW | postinstall network communication | 8 | newtab.htmlimg/bg.mp4js/script.js +5 more | - |
| LOW | postinstall crypto operations | 3 | _metadata/verified_contents.jsonjs/jquery-3.7.1.min.jsjs/script.js | - |
| LOW | postinstall obfuscation | 4 | js/sidePanel.jsnewtab.htmljs/background.js +1 more | - |
| LOW | postinstall system command | 2 | img/bg.mp4js/jquery-3.7.1.min.js | - |
| LOW | postinstall file download | 5 | js/script.jsjs/popup.jsjs/sidePanel.js +2 more | - |
| LOW | SQLInjection | 3 | js/script.jsjs/jquery-3.7.1.min.jsjs/todo.js | - |
| LOW | NoUseWeakRandom | 2 | js/createStickyNote.jsjs/jquery-3.7.1.min.js | - |
| LOW | LocalStorageShouldNotBeUsed | 3 | js/script.jsjs/createStickyNote.jsjs/todo.js | - |
| LOW | postinstall persistence mechanism | 1 | js/background.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(45 hits)Requested Permissions
4 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
What this extension is
Demon Lady Red Sun Live Wallpaper, version 1.1.2, is published on the Chrome store under [email protected] and has 14 users. The manifest declares no permissions and no host permissions. That detail outweighs everything else here: without tabs, cookies, history or scripting access, the extension has no standard route to the pages a person visits or the sessions they hold.
The six network findings
The only medium-severity items are request sites across four scripts: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Six fetch calls spread across a background worker, a popup, a side panel and a weather script is the shape of a wallpaper app pulling images and refreshing a forecast. The hosts that resolve to anything real support that reading: api.gameograf.com and gameograf.com belong to the publisher, and www.blogger.com, youtube.com and chat.openai.com are ordinary content and assistant endpoints. None is a search-hijack template, an exit node or a known credential-harvesting host.
Most of the endpoint list is not a list of endpoints
Roughly a dozen recorded strings cannot be hosts at all. sidepanel.open and sidepaneltoggle.is are Chrome side panel API property chains glued together with the .is country code. uł.nz, ɳua.sb, bg.mp, c0.de, ke.td, td.et, e7za.tl and ce.support are short fragments cut from minified or localized JavaScript. The rest of the volume is 50 IoC matches and 45 low-severity code-smell items, all pattern hits on ordinary JavaScript. That total describes the scanner's behaviour, not the extension's.
The counterargument
A skeptic has two fair points. The publisher field is an email address rather than a company name, and 14 users is no track record. chat.openai.com also stands out for a wallpaper product, though a side panel script calling an assistant endpoint is a plausible feature, and a request to a public chat domain carries no page data while the extension cannot read pages. The second point is stronger: a live wallpaper product needs a new tab override, and manifest analysis returned no findings at all, so how that override is wired stays unconfirmed. That is a gap to close with a manifest pass, not evidence of harm.
Why this reading holds
No malware signature matched. No obfuscation was detected. There are no secrets, no bundled dependencies and no tool-poisoning signals. Removing the extractor noise leaves a UI that makes six web requests, four of them in scripts whose names describe the feature they serve. A malicious extension at this capability level would need page access it never requested. The open item is the new tab override, and a second pass over the manifest is what would settle it.
Key Reasons
- Manifest declares no permissions and no host permissions, so the extension cannot read page content, cookies or history through the standard permission model
- The only medium-severity findings are six fetch call sites in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, all consistent with loading wallpaper and weather content
- No malware signatures, no obfuscation, no secrets, no dependencies and no tool-poisoning findings
- Endpoints that look alarming (sidepanel.open, sidepaneltoggle.is, uł.nz, ɳua.sb, td.et, c0.de) are API property chains and minified-JS fragments misread as domains
- Publisher's own api.gameograf.com and gameograf.com account for the real network destinations
False Positive Considerations
- XIOC extractor fragments misread as domains: sidepanel.open, sidepaneltoggle.is, uł.nz, ɳua.sb, td.et, c0.de, e7za.tl
- 45 low-severity code-smell rule matches on ordinary extension JavaScript
- Legitimate fetch calls in js/background.js and js/weather.js counted as network risk for a wallpaper app
- Publisher-owned api.gameograf.com and common content hosts counted toward endpoint volume
Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 80%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]