Lilo and Stitch Moonlight Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This Chrome extension, "Lilo and Stitch Moonlight Calm Aura Live Wallpaper," presents 330 total findings that are overwhelmingly false positives from the XIOC extractor. The 314 IoC findings are not evidence of malicious network activity but rather property access chains misread as domains. Findings titled XIOC-DOMAIN-t.call, XIOC-DOMAIN-s.call, XIOC-DOMAIN-se.call, XIOC-DOMAIN-k.call, XIOC-DOMAIN-i.call, XIOC-DOMAIN-o.call, XIOC-DOMAIN-oe.flat.call, and XIOC-DOMAIN-a.id match the documented false positive pattern where JavaScript property access like b.call or h.next is incorrectly parsed as domain names. These are not real network destinations.

The legitimate domains in the IoC list are ovkas.com (the developer's own domain, matching the email [email protected]) and jquery.org (a standard CDN for the jQuery library). These are expected for a browser extension and indicate normal operation.

Critically, the findings summary shows zero malware signatures, zero malware detections, zero obfuscation findings, and zero network findings. The 16 low-severity code-smell findings are consistent with the documented noise profile for basic JavaScript patterns. The extension's stated purpose—a live wallpaper for Chrome's new tab page—aligns with its actual behavior. There is no evidence of credential theft, browser hijacking, proxyware functionality, or malware delivery.

Strongest counterargument: The domains o.gd and v.et in the IoC list could represent shortlink services used for tracking or redirecting traffic. However, without accompanying malware signatures, obfuscation findings, or network findings showing actual data exfiltration, these isolated domain references do not constitute evidence of malicious behavior. The extension has 768 users and no reports of harmful activity. If these domains are used, they are likely for legitimate analytics or content delivery rather than malicious purposes. A skeptic would demand runtime analysis to confirm network behavior, but the static analysis evidence strongly favors a false positive classification.

The verdict is likely_false_positive because the finding volume is driven by known XIOC extractor garbage patterns, not actual malicious indicators. The developer attribution ([email protected]) is minimal but not suspicious, and the extension's functionality matches its description. No action is required beyond suppressing these false positive findings.

Key Reasons

• 314 IoC findings are property access chain false positives (t.call, s.call, a.id, etc.)
• Zero malware signatures and zero obfuscation findings
• Extension purpose (live wallpaper) matches stated functionality
• Legitimate domains present (ovkas.com, jquery.org)
• No network findings or credential theft indicators

False Positive Considerations

• XIOC property access chain misinterpretation
• IoC volume inflation from garbage patterns
• Code-smell rules on basic JavaScript patterns

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 85%.