Silent Hero of Hallownest Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension, "Silent Hero of Hallownest Live Wallpaper," presents 367 IoC findings but zero malware signatures, zero obfuscation findings, and no evidence of malicious behavior. The extension's stated purpose—a live wallpaper for the game Hollow Knight—aligns with its actual findings, which show no credential theft, browser hijacking, or data exfiltration patterns.

The IoC findings are dominated by short, generic top-level domains such as h.hm, f.sr, r.tt, m.vc, 3.ca, fw7.mn, and s.cu detected in extracted_from_files. These match the documented XIOC extractor false-positive patterns described in CVEQ's known issues: the extractor frequently misidentifies property access chains and hex substrings from minified JavaScript as domain names. Two findings reference legitimate Google CDN infrastructure: fonts.gstatic.com and fonts.googleapis.com, which are benign and commonly embedded in web applications.

One finding warrants attention: ӓ.cl contains a Cyrillic character (ӓ). While Cyrillic substitution is a known typosquatting technique, a single domain with this characteristic does not confirm impersonation without additional evidence such as similar naming to a known brand, matching icons, or deceptive descriptions. The extension name references Hollow Knight, a legitimate indie game, and does not impersonate a well-known extension.

The 16 code-smell findings are classified as low severity and match the documented noise patterns: generic JavaScript patterns that fire on almost any non-trivial code. Per CVEQ guidelines, code-smell findings should never drive a verdict.

Counterargument: A skeptic could argue that 367 IoC findings is too high to dismiss, and the personal Gmail publisher ([email protected]) lacks verification. However, finding COUNT is explicitly not evidence per the guidelines—the NATURE of findings matters. Zero malware signatures and zero obfuscation are strong indicators against malicious intent. The extension's category matches its behavior, and there is no evidence of credential theft, session hijacking, or proxyware functionality. The IoC pattern matches known XIOC false-positive behavior rather than actual malicious infrastructure.

Resolution: The evidence quality is moderate due to the absence of malware signatures and obfuscation, but the high IoC count creates some uncertainty. Additional runtime analysis could confirm whether the short TLD domains are actually contacted at runtime, but based on static analysis alone, this follows the likely_false_positive pattern.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation findings
• IoC findings match known XIOC false-positive patterns
• Extension category matches stated purpose (live wallpaper)
• No evidence of credential theft, browser hijacking, or data exfiltration

False Positive Considerations

• XIOC extractor false-positive patterns (short TLDs, property access chains)
• Code-smell findings (low severity, generic JavaScript patterns)
• Google CDN domains misclassified as suspicious (fonts.gstatic.com, fonts.googleapis.com)
• High IoC count without malware signatures or obfuscation

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 75%.