Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Metro 2039 The Stranger Live Wallpaper
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 4 months ago
- Version
- v14.4.1
- Artifact
- SHA256 ACA…355
- Source
- Findings (non-IoC)
Network indicator detail is shown below
322 aggregate findings were counted. 322 network indicators contributed to the aggregate finding count.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
Requested Permissions
1 permissionAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension 'Metro 2039 The Stranger Live Wallpaper' has been analyzed, and the findings suggest that it is likely a false positive. The evidence bundle contains 368 IoC findings, all of which are medium severity and detected by XIOC. However, upon closer inspection, these findings appear to be related to domain names that are not necessarily malicious. For example, the finding 'XIOC-DOMAIN-p.cy' detects the domain 'p.cy', which could be a legitimate domain. The absence of any malware signatures, obfuscation, or other suspicious findings suggests that this extension is likely benign. One potential counterargument to this verdict is that the extension has a large number of IoC findings, which could indicate malicious activity. However, as previously stated, these findings are likely related to benign domain names. Furthermore, the developer name '[email protected]' is not a known malicious actor, and the extension's description does not suggest any malicious intent. Therefore, based on the evidence, it is likely that this extension is a false positive. The strongest counterargument to this verdict would be that the extension's IoC findings could be indicative of a larger issue, such as a compromised developer account or a vulnerability in the extension's code. However, without further evidence, it is impossible to say for certain. In conclusion, while the extension's IoC findings are suspicious, the lack of any other suspicious activity and the benign nature of the domain names detected suggest that this extension is likely a false positive.
Key Reasons
- No malware signatures detected
- IoC findings appear to be related to benign domain names
- Absence of obfuscation or other suspicious findings
False Positive Considerations
- IoC extractor garbage
- XIOC domain detection
Reviewed 2026-06-04; recommended action: suppress false positive; model confidence 80%.
Source Code Not Available
Source code is not available for this version of the extension.