Moena Italy Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Moena Italy Live Wallpaper replaces the new tab page with a photograph of a village in the Italian Dolomites, then adds a weather readout and a side panel. The listing names a developer, [email protected], and the scan records no permissions and no host_permissions, so nothing here can read tabs, history, cookies or bookmarks.

The only behavioral findings are six fetch call sites: NET-FETCH-js/background.js-63, -82 and -96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Those land in the background worker, the popup, the side panel and a weather module, which is where you would expect an extension to download wallpaper images and a forecast. What is missing matters more than what is present. There is no search-provider override, no query template, no chrome.history call and no redirect. A new-tab hijack leaves those fingerprints, and this scan has none of them.

The 98 items bucketed as infrastructure indicators do not survive a second look. Entries such as 6㾦.za, huݗ.sa and nǘ.bo contain characters that cannot appear in a hostname at all. sidepanel.open and sidepaneltoggle.is are property chains from Chrome's side panel API, read as if they were domains. bb.nl, bg.mp, 0dl.dm and c5.gs are two and three character fragments cut out of minified variable names. None of them resolves, so none of them is a destination for your data. The remaining warnings are code-quality patterns that fire on nearly every bundled JavaScript file of this size, and not one carries a malware family name.

The strongest argument against this verdict is the category. Live-wallpaper new tab extensions have a long history of quietly becoming search hijackers, and a listing with 22 users, sales-copy description and a bare developer email is exactly the shape of a throwaway. That argument describes a risk profile, though, and profiles are not evidence. The behavioral test for a hijacker is a rewritten search endpoint or an outbound call carrying browsing data, and this scan shows neither. The fetch arguments in js/background.js and js/weather.js would settle it: parsing those URLs would confirm the extension talks to a wallpaper or weather host rather than something else.

For a wallpaper extension with a weather widget, fetching images and forecast data is the feature. Nothing in this scan shows the extension doing anything with that plumbing beyond drawing a picture and a temperature.

Key Reasons

• Zero malware signatures and zero obfuscation findings across 148 total findings
• All IoC entries are extractor artifacts from minified JS, including Unicode-garbled strings such as '6㾦.za', 'huݗ.sa' and 'nǘ.bo'
• The only behavioral findings are six fetch call sites in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, consistent with downloading wallpaper images and weather data
• No search-provider override, query template, history call or redirect, which is the fingerprint a new-tab hijacker would leave
• Extension declares no permissions and no host_permissions, and the publisher is identified by developer email [email protected]

False Positive Considerations

• IoC extractor producing garbage hostnames from minified JavaScript, including Unicode characters that cannot exist in a domain
• Chrome API property chains such as sidepanel.open and sidepaneltoggle.is misread as network endpoints
• 44 code-smell findings that fire on any non-trivial bundled JavaScript file
• Finding count inflated by dist/bundle output rather than by any malicious behavior

Reviewed 2026-10-16; recommended action: suppress false positive; model confidence 82%.