YoRHa Protocol 2B Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The YoRHa Protocol 2B Live Wallpaper extension (v1.4.3) shows 534 total findings, but the evidence does not support malicious behavior. All 517 medium-severity IoC findings are domain extractions from files (e.g., XIOC-DOMAIN-v.ca, XIOC-DOMAIN-k.gf, XIOC-DOMAIN-7.cm in extracted_from_files), which is expected for a live wallpaper extension that must host images from external CDNs. Critically, there are zero malware signatures, zero obfuscation findings, and zero network findings in the evidence bundle. The 17 code-smell findings are classified as noise per CVEQ's known false-positive patterns and do not indicate malicious code.

The extension's purpose—displaying animated wallpapers of YoRHa 2B from Nier:Automata—legitimately requires external image hosting. The short, random-looking domains (v.ca, i.bb, k.gf, 7.cm, mc.tr) are consistent with CDN shorteners commonly used for media hosting, not command-and-control infrastructure. The developer account ([email protected]) is a personal Gmail address, which is a minor concern but not indicative of malicious intent for this extension type.

Counterargument: A skeptic could argue the short, random domain names (e.g., v.ca, k.gf, i.bb) are suspicious and could indicate data exfiltration endpoints. However, without malware signatures, obfuscation, or network findings demonstrating actual data transmission, there is no evidence of malicious behavior. The absence of obfuscation findings is particularly significant—malicious extensions using these domains would almost certainly obfuscate their code to evade detection. The IoC extractor is documented to produce false positives from image URLs and CDN references, which explains the 517 domain findings without implying threat.

Key Reasons

• Zero malware signatures and zero obfuscation findings despite 534 total detections
• IoC domains are consistent with CDN image hosting for a live wallpaper extension
• No network findings demonstrating actual data exfiltration or C2 communication
• Code-smell findings are known false positive patterns per CVEQ guidelines
• Extension type (live wallpaper) legitimately requires external image sources

False Positive Considerations

• IoC extractor domain detection from image URLs
• Code-smell rules matching benign patterns
• Bundled image assets triggering domain extraction

Reviewed 2026-04-30; recommended action: suppress false positive; model confidence 82%.