Hiyuki Dance of the Frostblade (WuWa) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension Hiyuki Dance of the Frostblade (WuWa) Live Wallpaper contains a large number of domain‑related IoC findings, all reported from the generic source path extracted_from_files. Each finding, such as XIOC‑DOMAIN‑ce.support, XIOC‑DOMAIN‑i.support, XIOC‑DOMAIN‑b.find.id, and XIOC‑DOMAIN‑jquery.org, is labeled with medium severity but none of them correspond to known malicious or tracking services; many appear to be fragments of code or placeholder strings that the XIOC extractor commonly mis‑interprets as domains. No malware‑signature, obfuscation, network‑request, or credential‑access findings were reported, and the manifest analysis returned no suspicious permissions or background scripts. The lack of any code‑smell or secret‑type findings further supports the conclusion that the extension’s code is largely benign and does not attempt to harvest data, hijack the browser, or inject payloads.

The developer is listed only by an email address ([email protected]) with no corporate attribution, which is typical for small personal projects and does not, by itself, imply malicious intent. The extension’s description advertises a live‑wallpaper visual effect, and there is no evidence of deceptive naming or icon copying that would indicate typosquatting. The user count is zero, suggesting the extension has not been widely installed, which limits exposure but also means there is little community feedback to contradict the technical findings.

The most plausible explanation for the abundant IoC entries is the known behavior of the XIOC extractor, which frequently flags strings that look like domain names inside minified JavaScript bundles. Because the extension likely bundles third‑party libraries (e.g., jQuery, hinted by the XIOC‑DOMAIN‑jquery.org entry), the extractor surfaces dozens of such false positives. This pattern matches the documented IoC Extractor Garbage scenario, where generic strings and library identifiers inflate the IoC count without representing real network activity.

A skeptic might argue that the presence of multiple unfamiliar domains (e.g., ce.support, b.filter.id) could indicate a hidden command‑and‑control server or data‑exfiltration endpoint. However, without any network‑request findings, DNS‑resolution code, or explicit fetch/XMLHttpRequest calls targeting those domains, the evidence remains speculative. Moreover, the XIOC findings alone cannot prove that the extension contacts these hosts; they merely reflect static string analysis. In the absence of corroborating dynamic behavior or malware signatures, the safest interpretation is that these are benign artifacts of static scanning.

Consequently, the overall risk profile is low, and the findings are best explained by known false‑positive mechanisms rather than actual malicious functionality. The extension can be considered safe pending a routine re‑scan after any future updates.

Key Reasons

• All findings are generic domain IoCs from static analysis
• No malware signatures or obfuscation detected
• No network or credential‑theft behavior observed
• Developer listed only by personal email, typical for small projects
• Patterns match known XIOC false‑positive behavior

False Positive Considerations

• IoC extractor garbage
• bundled third‑party libraries
• absence of malware signatures
• no network or credential findings

Reviewed 2026-06-02; recommended action: suppress false positive; model confidence 81%.