Spider-Man Miles Morales Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Spider-Man Miles Morales Live Wallpaper extension (v2.0.0) has 366 total findings, but these are driven entirely by known false-positive patterns rather than actual malicious behavior.

The 348 IoC findings are all XIOC extractor garbage. The extracted "domains"—including o.call, i.call, n.call, ce.map, ue.call, h.sv, and n.to—are JavaScript property access chains being misinterpreted as domain names. For example, o.call is not a real domain; it is a minified JavaScript variable accessing a .call property. This is explicitly documented in the CVEQ false-positive patterns: "Property access chains misread as domains: b.call, h.next, g.id" are IoC Extractor Garbage. None of these are actual network destinations.

There are zero malware signatures, zero obfuscation findings, and zero network findings. The 18 code-smell findings are classified as low severity and match benign patterns like basic Node.js operations (fetch, exec, fs, crypto). These are explicitly called out in the guidelines as noise that should "NEVER drive a verdict."

The extension has legitimate metadata: developer email [email protected] provides attribution, the description clearly states it's a live wallpaper for Chrome Newtab, and the user count (604) is modest for a themed wallpaper extension. The functionality described (Spider-Man Miles Morales live wallpaper) is consistent with the extension's stated purpose.

Counterargument: A skeptic might argue that 348 IoC findings is an unusually high count and warrants concern. However, finding count is explicitly not evidence—finding nature is. All 348 IoCs follow the exact false-positive pattern documented in the CVEQ guidelines. If these were real malicious domains, we would expect to see network findings showing actual communication to those domains, malware signatures, or obfuscation hiding the behavior. None of these exist. The absence of any corroborating malicious indicators (malware signatures, obfuscation, network findings) combined with the presence of only known false-positive IoC patterns confirms this is a false positive driven by the XIOC extractor's known weakness with minified JavaScript property access chains.

Key Reasons

• All 348 IoC findings are XIOC extractor false positives (property access chains like o.call, i.call, ce.map)
• Zero malware signatures detected
• Zero obfuscation findings
• Zero network findings showing actual suspicious communication
• Developer attribution exists ([email protected]) with legitimate extension purpose

False Positive Considerations

• XIOC-DOMAIN property access chain false positives (o.call, i.call, n.call, ce.map)
• Code-smell findings classified as low severity (18 findings)
• Minified JavaScript triggering IoC extractor garbage

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 85%.