Luffy in Gear 5 Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Luffy in Gear 5 Live Wallpaper, version 1.2.5, is a Chrome new tab replacement built around an animated anime wallpaper. The manifest declares no permissions and no host permissions. That matters more than any finding count here: without tabs, cookies, history, scripting or host access, the extension cannot read other pages or lift session data. Whatever it does, it does inside the new tab page it owns.

The 469 IoC entries are extractor noise. The endpoint list holds entries like 0i.gh, 2c.fk, 4d.mc and 5р.cx, that last one carrying a Cyrillic er where a Latin p belongs. Each entry is a short alphanumeric fragment followed by a two-letter country TLD. That is the shape of minified variable chains, not of servers. No entry names a recognizable provider, and the usual hijack shapes are absent: no query.*, search.* or hp.* host appears anywhere in the list, and no search engine template is declared.

The five network findings are bare fetch detections with no destination attached: NET-FETCH-js/background.js-51 and NET-FETCH-js/background.js-65 in the service worker, NET-FETCH-js/popup.js-39 in the popup, NET-FETCH-js/sidePanel.js-362 in the side panel, and NET-FETCH-js/weather.js-49 in the weather module. The last one explains itself, since new tab dashboards commonly pull a local forecast for a widget, and the file is named for exactly that. background.js and popup.js making requests fits the same shape: loading wallpaper assets and stored settings.

The 43 code-smell findings are the generic JavaScript quality rules that fire on nearly any bundled script. They are classified low and should not carry weight. Nothing else matched at all: zero malware signatures, zero obfuscation, zero dependency, zero secret and zero tool-poisoning findings. An extension shipping an actual payload would normally trip at least one of those categories.

A skeptic would point at the listing's shape rather than the findings. A wallpaper extension that also ships a weather module and a side panel, published under a Gmail address ([email protected]) with no installs, is how new tab monetization often begins: the early build stays clean, and a later update adds a search redirect or a sponsored tile. That is a fair reading of the risk, and it is the reason this profile deserves a fresh scan after any version bump. It does not make this version a hijacker. Redirecting a user requires host permissions, a search provider override, or a proxy configuration, and none of those appear in the manifest data or the endpoint list.

The one real gap is that the fetch findings record a line number and no URL. If a future scan captures the actual host behind NET-FETCH-js/background.js-51 or NET-FETCH-js/weather.js-49 and it resolves to a known tracker, that changes everything, because a redirect has to land somewhere. Until then, the evidence describes a lightweight new tab page, not a compromised browser.

Key Reasons

• Manifest declares no permissions and no host permissions, so the extension cannot read other tabs, cookies or history.
• 469 IoC entries are short fragments with two-letter TLDs such as 0i.gh and 2c.fk, matching minified JS misread as domains rather than real hosts.
• Zero malware-signature, obfuscation, dependency, secret and tool-poisoning findings across 517 total.
• The five network findings are unattributed fetch calls in background.js, popup.js, sidePanel.js and weather.js, consistent with loading wallpaper assets and a forecast widget.
• 43 code-smell findings are low-severity generic JavaScript rules that fire on any bundled script.

False Positive Considerations

• XIOC extractor splitting minified JavaScript into fake two-letter-TLD domains
• Generic code-smell rules firing on ordinary bundled JavaScript
• Line-level NET-FETCH detections that record no destination host
• Empty permission set leaves nothing for high-risk findings to attach to

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 72%.