Deku And Shigaraki Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension "Deku And Shigaraki Wallpaper" (version 4.60) presents 811 total findings, but the nature of these findings does not indicate malicious behavior. The 786 IoC findings include domains like p.ag, qwa.to, z4.cf, hw.jo, and a.ph detected in the finding XIOC-DOMAIN-p.ag with file_path extracted_from_files. The file_path indicates these are string patterns extracted from files, not confirmed network destinations.

Critically, there are zero malware signatures and zero obfuscation findings. The findings_summary shows "malware-signature":"0" and "malware":"0" and "obfuscation":"0". Without malware signatures or obfuscation, there is no evidence of intentional malicious code. The two network findings (NET-FETCH-js/script.js-17) represent standard fetch API calls, not connections to the suspicious domains listed in IoCs.

The 23 code-smell findings are classified as low-severity and match known false-positive patterns from the CVEQ documentation. These trigger on basic JavaScript patterns and should not drive verdicts. The extension's stated purpose—providing My Hero Academia wallpapers—aligns with having numerous image hosting domains and CDN endpoints in its code.

The developer uses an email address ([email protected]) rather than a verified company name, which is a weak signal but not sufficient for a malicious verdict absent other indicators. The user count of 365 suggests limited adoption, reducing potential harm even if the extension were problematic.

Counterargument: A skeptic would argue that domains like p.ag, qwa.to, and z4.cf are commonly used for command-and-control infrastructure and their presence indicates malicious intent. However, the evidence does not show these domains being actively contacted. The file_path: extracted_from_files indicates static string matches, not runtime network activity. The single network finding NET-FETCH-js/script.js-17 does not specify a destination, and there are no network findings explicitly connecting to the IoC domains. Without confirmed network traffic to these domains or malware signatures, the IoC findings represent noise from legitimate wallpaper hosting services or image CDNs rather than malicious infrastructure.

The extension's behavior matches its description: delivering anime wallpapers requires hosting images on external services. The high IoC count stems from the XIOC extractor's known false-positive patterns with image URLs and CDN endpoints, not from malicious code.

Key Reasons

• Zero malware signatures despite 811 total findings
• Zero obfuscation findings
• IoC file_path indicates string extraction, not confirmed network traffic
• Minimal network activity (2 findings) inconsistent with malicious behavior
• Extension purpose (wallpapers) explains external domain references

False Positive Considerations

• XIOC extractor matching image hosting URLs as domains
• Code-smell rules firing on standard JavaScript patterns
• Wallpaper delivery requiring external CDN/image service domains
• String pattern extraction vs. actual network destination confirmation

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 75%.