Kimetsu No Yaiba Demon Slayer Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension claims to provide Demon Slayer-themed live wallpapers for new tab pages. The evidence shows 503 total findings, but 465 of these are IoC detections that are predominantly benign Google service domains (contacts.google.com, news.google.com, www.gstatic.com, maps.google.com, translate.google.com). These are standard Google infrastructure domains and represent false positives from the XIOC extractor.

The four non-Google domains (el.style.top, note.dataset.id, data.top, note.style.top) appear in the IoC findings without specific file paths showing how they're used. While the .top TLD can be associated with low-cost hosting, these domains lack characteristics of known malicious infrastructure. They could legitimately serve wallpaper content or style resources for the extension's new tab functionality.

The three network findings show fetch calls in js/popup.js:29, js/script.js:45, and js/newsBar.js:17. These are generic network activity detections that do not reveal destination URLs. A wallpaper extension would reasonably need to fetch content from external sources, making these findings functionally consistent with the extension's stated purpose.

The 35 code-smell findings are classified as low severity. Per CVEQ's documented false-positive patterns, code-smell rules (postinstall_*, credential_*, code-quality rules) fire on almost any non-trivial JavaScript and should NOT drive verdicts. The absence of malware signatures (0 findings) and obfuscation (0 findings) is significant—confirmed malicious extensions typically show at least one malware signature co-located with obfuscation.

The strongest counterargument is the presence of the four non-Google domains and the developer's unverified email ([email protected]) with zero user count. A skeptic would argue these could indicate a new malicious extension using fresh domains. However, without malware signatures, obfuscation, or evidence of credential/session theft behavior, this remains speculative. The extension's functionality (wallpaper display) does not inherently require access to sensitive data, and the network findings are consistent with legitimate content fetching. The verdict would change to needs_follow_up if runtime analysis showed data exfiltration to the .top domains, but static analysis alone does not support a malicious classification.

Key Reasons

• 465 of 503 findings are benign Google domain IoCs
• Zero malware signatures detected
• Zero obfuscation findings
• Code-smell findings are documented false positives
• Network activity consistent with stated wallpaper functionality

False Positive Considerations

• Google CDN/infrastructure domains flagged as IoCs
• Code-smell YARA rules on generic JavaScript
• XIOC extractor domain detection without file context
• Bundled code triggering multiplicative IoC matches

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 75%.