Ken Kaneki Tokyo Ghoul Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension "Ken Kaneki Tokyo Ghoul Live Wallpaper" (version 4.4.3) shows no evidence of malicious behavior despite 366 total findings. Zero malware-signature findings, zero malware findings, and zero obfuscation findings rule out confirmed malicious code. The 349 IoC findings all follow the pattern of XIOC extractor garbage documented in CVEQ guidelines: 2-character subdomains with unusual TLDs including ce.map, w.gd, h.lu, yd.cm, x.sn, k.bg, ʸ.gi, y.cd, y.vg, q.pt, s.so, and y.km. These domains match the documented false-positive pattern of property access chains being misread as domains (e.g., w.gd could be window.gd or similar JavaScript property access). The generic file path "extracted_from_files" for all IoC findings indicates these were not extracted from actual network requests or specific code locations. Critically, the findings summary shows 0 network findings despite 349 IoC findings, proving these domains are not being contacted in actual network traffic. The 17 low-severity code-smell findings represent expected YARA noise on any JavaScript extension, matching the documented pattern that code-smell findings (severity=low, finding_type=code-smell) are noise and should never drive a verdict. The extension description matches its category: anime live wallpaper functionality is legitimate and matches the extension name. The developer email [email protected] is anonymous but not inherently suspicious for small extensions with 26 users.

The strongest counterargument is that 349 IoC findings represents a large volume of suspicious domains from an anonymous developer. This argument fails because finding count is not evidence—finding nature is evidence. The XIOC extractor is documented to produce massive false-positive volumes, specifically including 2-character domain patterns like those found here. Zero malware signatures is the definitive signal: confirmed malicious extensions have malware signatures co-located with obfuscation and suspicious domains. This extension has none of those indicators. The absence of network findings confirms these IoCs are not from actual network activity. Suppressing these false positives aligns with CVEQ's documented scoring bias where confirmed false positives average risk score 83.2 despite being benign.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• All 349 IoC findings match documented XIOC false-positive patterns (2-character domains)
• Zero network findings despite 349 IoC findings proves domains are not contacted
• 17 code-smell findings are low-severity YARA noise on JavaScript
• Extension functionality matches description (anime wallpaper)

False Positive Considerations

• XIOC-DOMAIN extractor garbage (2-character subdomains)
• Code-smell YARA rules on JavaScript
• Generic file path extraction (extracted_from_files)
• No actual network findings to validate IoCs

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 78%.