Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Power Chainsaw Man Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 1 weeks ago
- Version
- v4.61
- Artifact
- SHA256 D7F…7AA
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 1 | js/background.js | - |
| LOW | postinstall file manipulation | 14 | js/dragPopup.jscss/style.cssjs/calendar.js +11 more | - |
| LOW | postinstall crypto operations | 3 | _metadata/verified_contents.jsonjs/jquery-3.7.1.min.jsjs/script.js | - |
| LOW | postinstall network communication | 7 | js/chatgpt.jsjs/countdownTimer.jsjs/background.js +4 more | - |
| LOW | postinstall obfuscation | 4 | js/sidePanel.jsjs/background.jsnewtab.html +1 more | - |
| LOW | postinstall system command | 2 | img/bg.mp4js/jquery-3.7.1.min.js | - |
| LOW | postinstall file download | 5 | js/sidePanel.jsjs/weather.jsjs/background.js +2 more | - |
| LOW | SQLInjection | 3 | js/script.jsjs/jquery-3.7.1.min.jsjs/todo.js | - |
| LOW | NoUseWeakRandom | 2 | js/createStickyNote.jsjs/jquery-3.7.1.min.js | - |
| LOW | LocalStorageShouldNotBeUsed | 3 | js/createStickyNote.jsjs/script.jsjs/todo.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(44 hits)Requested Permissions
4 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality weak.
The CVEQ analysis bundle for 'Power Chainsaw Man Live Wallpaper' (version 4.60) contains an empty findings_by_category object, meaning zero security findings were detected across all categories. This extension presents as a live wallpaper for the anime series Chainsaw Man, which is a legitimate use case for browser extensions.
The developer attribution shows an email address ([email protected]) rather than a verified company name, which is common for smaller developers but prevents verification of publisher identity. The user count of 78 is very low, indicating this is a niche extension without widespread adoption. However, low user count alone does not indicate malicious intent.
Critically, the findings_by_category object is completely empty. There are no IoC findings (no suspicious domains, IPs, or URLs), no code-smell findings (no YARA rule matches), no obfuscation findings, and no malware signatures. This is a stark contrast to the typical pattern where even benign extensions trigger numerous false-positive findings from bundled dependencies, minified code, or generic code patterns.
The strongest counterargument to this verdict would be that the empty findings bundle represents a scan failure rather than a clean result. A skeptic might argue that without evidence of what files were scanned or how many files were analyzed, we cannot confirm the scan ran properly. However, the version field shows '4.60' (not 'unknown'), and the extension metadata is complete (name, description, developer, user count, store, uuid). If this were truly incomplete_data, we would expect missing or placeholder values in these fields. The extension has a coherent purpose (live wallpaper), a descriptive title, and emoji in the description consistent with legitimate anime fan content.
Given the complete absence of any findings and the legitimate-sounding functionality, the appropriate classification is likely_false_positive. The scoring system may have inflated risk metrics due to the absence of data, but the actual evidence shows no malicious indicators. The recommended action is to monitor rather than escalate, as there is no evidence of harm.
Key Reasons
- Zero findings detected across all categories
- Legitimate live wallpaper use case
- No suspicious domains or code patterns identified
- Complete metadata present
False Positive Considerations
- empty_findings_bundle
- low_user_count
- email_developer_attribution
Reviewed 2026-04-26; recommended action: monitor; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]