Storm King Fortnite Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Storm King Fortnite Live Wallpaper (version 4.61, 304 users) produces exactly one category of finding: six medium-severity network detections, at js/background.js:63, js/background.js:82, js/background.js:96, js/popup.js:39, js/sidePanel.js:362 and js/weather.js:49. Nothing else fired. There is no malware signature, no IoC, no obfuscation, no dependency finding, no secret and no code-smell rule. The manifest as captured declares no permissions and no host_permissions.

The nature of those six detections is what decides this. A new-tab replacement that renders live video and shows a weather readout has to load assets and, for the weather panel, request data. A fetch call sitting in js/weather.js is precisely the shape that feature takes from the outside. The calls in js/background.js and js/sidePanel.js sit in the files that pick and render wallpaper and drive the side panel menu. None of them is bundled with anything that reads cookies, injects scripts into pages, or rewrites a search provider.

The declared permissions support that reading. In Manifest V3 an extension page cannot fetch a cross-origin URL without matching host permission. With host_permissions empty, either the manifest snapshot is partial or those fetch calls target files packaged inside the extension. Neither possibility shows data leaving the browser.

A skeptic would push back on two points. First, the extension carries Fortnite branding with no visible link to Epic Games, and its publisher is a bare address at gameograf.com rather than a named company, so it fits the shape of a template new-tab product built to be monetized. Second, the network findings have no resolved destinations, so we are judging call sites without seeing where they point. Both are fair. The reason they do not change the verdict is that every high-prevalence hijack and theft pattern is absent: no chrome_url_overrides search provider swap is evidenced, no IoC domain appears, and no permission grants access to tabs, history, cookies or page content. A monetized wallpaper page and a hijacker look different in the manifest, and this one has the empty permission set of the former.

What would flip this: resolved endpoint URLs for js/background.js:63 or js/weather.js:49 pointing at a domain the developer does not operate, a manifest revision adding content scripts for http/https pages, or a search-engine override. Until one of those appears, the six fetch findings describe ordinary feature code.

Key Reasons

• All six findings are NET-FETCH detections in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, matching the asset and data loading a new-tab wallpaper extension performs.
• Zero malware signatures, zero IoCs, zero obfuscation and zero code-smell findings across the scan.
• The manifest declares no permissions and no host_permissions, so there is no access to cookies, tabs, history or page content.
• No search-engine override, custom URL template or other browser-hijack mechanism appears in the evidence.
• The publisher is an identifiable developer address at gameograf.com with a versioned release history (4.61).

False Positive Considerations

• NET-FETCH rules fire on any fetch() call in extension JavaScript regardless of destination or purpose.
• The network endpoint list is empty, so fetch targets were never resolved and the call sites were scored without their destinations.
• Low finding volume with no corroborating malware, IoC or obfuscation signal leaves only a benign code pattern.

Reviewed 2026-10-26; recommended action: suppress false positive; model confidence 80%.