Snorlax With Friends Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

Snorlax With Friends Live Wallpaper is a Chrome extension that replaces the new tab page with a Pokemon-themed live wallpaper. It is published under the developer contact [email protected], sits at version 1.1 and has around 335 users. The scan produced six findings, and all six are the same kind: NET-FETCH entries in js/background.js (lines 63, 82 and 96), js/popup.js (line 39), js/sidePanel.js (line 362) and js/weather.js (line 49). Each records a call to fetch inside a script that ships with the extension.

That is the whole of the evidence. There are no malware signatures, no IoC hits, no obfuscation findings, no bundled dependency flags, and nothing in the credential or secret categories. The extension declares no permissions and no host permissions in the extracted manifest data, and no network endpoints were captured alongside the fetch findings.

The fetch calls line up with the product. A wallpaper extension with a weather widget has to call a weather service, and js/weather.js doing that is the least surprising thing in the bundle. js/sidePanel.js and js/popup.js making requests fits a UI that loads wallpaper lists or configuration. The finding titles carry no URL, so we cannot say which hosts are contacted, and we should not pretend otherwise. What we can say is that the code pattern matches the stated function of the extension. Finding counts carry no weight here: the scanner flags every use of fetch in a bundled script, and an extension that renders remote wallpaper art will produce one, six or twenty such flags depending on how the source is split across files. There is no suspicious domain in the evidence, no dynamic URL template construction, no search provider override, and no code reading cookies or credentials.

The strongest argument against this verdict is the empty permission list. An extension that advertises a new tab page normally declares a newtab override and the host access needed to load wallpaper art, and here both the permissions and host permissions arrays come back empty. An empty result can mean the manifest extractor failed to parse the file, and if it failed there, it may have failed elsewhere in the same pass. A second objection is that a Pokemon wallpaper new tab from a small studio address is the classic profile of a low-effort monetized extension. Both points deserve an answer. For a hijack verdict we would need a search engine or homepage override in the manifest, and none appears anywhere in the evidence. For an exfiltration verdict we would need a suspicious destination, and the bundle lists no destinations at all, only the fact that fetch exists in four files. A generic capability flag with no destination and no corroborating category is not a finding about behavior.

The practical check is to load the extension and watch the network tab while opening a new tab, which would name the hosts behind js/background.js and js/weather.js in about two minutes. Until such a host shows up, these six entries describe normal remote content loading in a wallpaper extension.

Key Reasons

• The only findings are six NET-FETCH entries (js/background.js:63, :82, :96, js/popup.js:39, js/sidePanel.js:362, js/weather.js:49), each recording that fetch is called with no URL captured.
• Zero IoC, malware-signature, obfuscation, dependency, secret and code-smell hits, so nothing corroborates the network flags.
• The fetch locations match the advertised product: a weather module and side panel in a new-tab wallpaper extension.
• No search provider override, homepage override or dynamic URL construction appears anywhere in the evidence.
• The empty permissions and host_permissions arrays point to a manifest extraction gap rather than hidden capability.

False Positive Considerations

• NET-FETCH findings record only that fetch exists in a bundled script, with no destination, so they carry no behavioral information.
• Empty permission and host_permission arrays suggest the manifest was not fully parsed, which can skew what the scan reports.
• No corroborating categories (malware signature, IoC, obfuscation) accompany the network findings.
• A weather widget and side panel explain network calls in a new-tab wallpaper extension without any suspicious domain.

Reviewed 2026-10-14; recommended action: suppress false positive; model confidence 72%.