The Iconic Power of Spiderman Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension replaces Chrome's new tab page with Spiderman live wallpapers, and its manifest declares no API permissions and no host permissions. The shipped scripts are js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, and those four files hold the only behavioural findings in the scan. Five fetch call sites were recorded: js/background.js:51, js/background.js:65, js/popup.js:39, js/weather.js:49 and js/sidePanel.js:362. A weather readout and a wallpaper gallery both need a server, so network calls sitting in weather.js and sidePanel.js match the advertised feature set. Nothing in the file list sets a search provider, rewrites the address bar, or touches cookies.

The 218 domain hits are extraction artifacts. Most are two-letter dot two-letter strings such as el.ax, ga.mx, hb.dj, gx.hr and jb.tg, which is the shape of a property access in minified code (a.bx). One entry, bկ.bf, contains an Armenian letter and cannot be a hostname at all. jquery.org sits in the same list because the bundle carries jQuery text. Returning that many matches from a wallpaper extension's bundled JavaScript is expected.

The 42 code-quality findings cover the usual JavaScript rules that fire on any non-trivial bundle: eval-pattern checks, weak randomness, string concatenation. None of them describe behaviour a wallpaper page could not already perform.

What does carry weight is what is absent. Across 265 total findings there are zero malware signatures, zero obfuscation findings, zero secret findings and zero tool-poisoning findings. Obfuscation in particular would be the expected companion to a hidden payload, and none was recorded. A wallpaper extension with no permissions also has very little to work with: without host permissions it cannot read page content, cookies or the tabs API, so the data it could send back is limited to what it fetches itself.

A skeptic would answer that the endpoint list includes 9vzpe.su, fgf9.to and j6y.kg, three random-looking names on TLDs that throwaway infrastructure favours, and that the publisher is a bare gmail address ([email protected]) behind a keyword-stuffed title with no user base. That is a fair read of a mass-produced new tab extension, and the trademark-heavy name does not help. The verdict still holds because the suspicious strings never resolve into capability: no permission, no code that reads browsing data, and no matched signature tying any of those names to a request the extension actually makes. The gap that remains is the destination URL at each of the five fetch call sites, which the scan logs by line number only. Reading those five lines would close it.

Key Reasons

• No malware signatures, obfuscation, secret or tool-poisoning findings across 265 total matches
• Manifest declares no API permissions and no host permissions, so the extension cannot read cookies, page content or browsing history
• The 218 IoC hits are short two-letter property-chain fragments (el.ax, ga.mx, hb.dj, gx.hr) plus an invalid Unicode string bկ.bf and the library domain jquery.org
• The five fetch call sites are confined to js/background.js, js/popup.js, js/weather.js and js/sidePanel.js, files consistent with a wallpaper gallery and weather widget
• The 42 code-smell findings are generic JavaScript quality rules that fire on any bundled code

False Positive Considerations

• IoC extractor pulling minified property-access chains (el.ax, ga.mx, hb.dj, jb.tg) and Unicode fragments (bկ.bf) as domains
• Library strings from bundled jQuery surfacing as network endpoints
• Generic code-quality YARA rules (eval patterns, weak randomness) matching any non-trivial JavaScript
• No obfuscation findings to corroborate the IoC volume

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 70%.