K-pop Demon Hunters Live Wallpaper Funny

AI Security Review

Evidence context: threat category none; evidence quality moderate.

K-pop Demon Hunters Live Wallpaper Funny is a Chrome new tab replacement (version 1.1, 412 users) published under the contact address [email protected]. The manifest declares no permissions and no host permissions. That carries more weight than the finding list: without tabs, cookies, history, scripting or any host access, there is no declared path from this extension to browsing data, session tokens or page content. What is left is script-level network access.

All six findings are medium-severity network entries of the same shape. NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82 and NET-FETCH-js/background.js-96 sit in the service worker, the ordinary place to refresh wallpaper assets or re-read a cached settings payload. NET-FETCH-js/popup.js-39 and NET-FETCH-js/sidePanel.js-362 land in the popup and side panel UI scripts, which typically pull thumbnails or configuration JSON. NET-FETCH-js/weather.js-49 is the most explainable of the set: the store listing promises a live animated new tab, and a file named weather.js making one request is consistent with a forecast or location lookup. A fetch call is the mechanism every extension uses to download an image or a JSON file; the rule fires on the API, not on a destination.

Nothing corroborates a worse reading. There are no malware signatures, no obfuscation results, no dependency findings, no code-smell hits, no secrets and no IoC entries at all. The bundle records no endpoint strings, which cuts both ways: it means no suspicious host is named, and also that no host can be cleared. The manifest is small, with no bundled libraries to multiply findings.

A skeptic would say that zero declared permissions plus six outbound calls is exactly the profile of a quiet data collector, and that the publisher is an email address rather than a company. That is a fair objection. The answer is that the evidence shows a channel and never a destination: no obfuscated payload alongside the calls, no embedded host list, no cookie or storage read, no permission request that would grant access to anything worth sending. A build doing exfiltration would normally show at least one of those in the same files. Capturing the resolved URLs behind js/weather.js:49 and js/background.js:63 in a live session is the single step that would close the gap; until then the file names and the empty permission set point away from abuse.

Key Reasons

• All six findings are fetch calls in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, matching a wallpaper plus weather new tab
• Manifest declares no permissions and no host permissions, leaving no declared access to cookies, history or page content
• No malware signatures, obfuscation, IoCs, dependency findings, code-smell hits or secrets in the bundle
• js/weather.js:49 is consistent with the weather widget described in the store listing
• No endpoint strings were extracted, so no suspicious host is named anywhere in the evidence

False Positive Considerations

• Network rule fires on any fetch() call, so ordinary wallpaper and weather requests generate medium findings by design
• Zero endpoint strings extracted, so destinations are unknown rather than suspicious
• No bundled dependencies or minified libraries to multiply finding counts
• Absence of declared permissions means no capability-based finding can corroborate a data-access concern

Reviewed 2026-10-17; recommended action: runtime analysis; model confidence 78%.