Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Stranger Things 5 Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 8 months ago
- Version
- v1.0
- Artifact
- SHA256 1A3…709
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
9 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | postinstall crypto operations Cryptographic operations detected | 2 | _metadata/verified_contents.jsonjs/jquery-3.7.1.min.js | Risky Plugins Authors FP 30% |
| HIGH | NoUseWeakRandom When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead. For more information checkout the CWE-338 (https://cwe.mitre.org/data/definitions/338.html) advisory. | 2 | js/jquery-3.7.1.min.jsjs/createStickyNote.js | FP 5% |
| HIGH | postinstall network communication Network communication detected | 4 | newtab.htmljs/chatgpt.jsimg/bg.mp4 +1 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 13 | js/bg.jsjs/calculator.jsjs/jquery-3.7.1.min.js +10 more | Risky Plugins Authors FP 20% |
| HIGH | postinstall system command System command execution detected | 2 | img/bg.mp4js/jquery-3.7.1.min.js | Risky Plugins Authors FP 10% |
| HIGH | postinstall file download File download activity detected | 3 | js/script.jsjs/newsBar.jsjs/popup.js | Risky Plugins Authors FP 30% |
| HIGH | postinstall obfuscation Code obfuscation techniques detected | 1 | js/jquery-3.7.1.min.js | Risky Plugins Authors FP 20% |
| HIGH | LocalStorageShouldNotBeUsed Session storage and local storage are HTML 5 features which allow developers to easily store megabytes of data client-side, as opposed to the 4Kb cookies can accommodate. While useful to speed applications up on the client side, it can be dangerous to store sensitive information this way because the data is not encrypted by default and any script on the page may access it. This rule raises an issue when the localStorage and sessionStorage API's are used. For more information checkout the OWSAP A3:2017 (https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html) advisory. | 4 | js/script.jsjs/popup.jsjs/todo.js +1 more | FP 5% |
| HIGH | SQLInjection SQL queries often need to use a hardcoded SQL string with a dynamic parameter coming from a user request. Formatting a string to add those parameters to the request is a bad practice as it can result in an SQL injection. The safe way to add parameters to a SQL query is to use SQL binding mechanisms. For more information checkout the CWE-564 (https://cwe.mitre.org/data/definitions/564.html) and OWASP A1:2017 (https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html) advisory. | 3 | js/script.jsjs/todo.jsjs/jquery-3.7.1.min.js | FP 10% |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
9 rules(34 hits)Requested Permissions
2 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The Stranger Things 5 Live Wallpaper extension triggers multiple YARA rule matches, including postinstall_file_manipulation and postinstall_network_communication, across various JavaScript files such as bg.js, chatgpt.js, and script.js. These findings are primarily driven by code-smell rules that are known to produce false positives, especially in the context of bundled dependencies and minified JavaScript. Notably, there are no specific, non-generic suspicious domains or malware signatures that indicate intentional harm. The network findings, such as NET-FETCH-js/popup.js-29, NET-FETCH-js/newsBar.js-17, and NET-FETCH-js/script.js-45, suggest the extension makes network calls, but without more context, these are not inherently malicious. A skeptic might argue that the volume of findings, including multiple YARA rule matches, suggests malicious intent. However, given the nature of these findings as code-smell and the lack of concrete evidence of malware or suspicious behavior, it's more reasonable to conclude that these are false positives driven by the characteristics of the extension's codebase rather than malicious activity. The strongest counterargument to this verdict would be the presence of actual malware signatures or clear indicators of malicious behavior, which are not present in this case. Therefore, the extension's findings are more aligned with known false-positive patterns than with indicators of malicious intent.
Key Reasons
- No malware signatures matched
- Findings driven by code-smell rules
- No suspicious domains detected
False Positive Considerations
- YARA code-smell rules
- bundled dependencies
Reviewed 2026-05-24; recommended action: suppress false positive; model confidence 80%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]