One Piece Ablaze Live Wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

Security Analysis: One Piece Ablaze Live Wallpaper

This Chrome extension presents significant adware concerns based on its infrastructure footprint. The evidence shows 405 IoC findings concentrated in the ioc category, with domains including j.cv, o.to, h.to, y.ls, y.by, r0.ad, and 4o.is. These are not legitimate service domains (Google, CDN, infrastructure) but rather short, 2-3 character domains characteristic of URL shorteners, ad networks, and tracking services. A legitimate live wallpaper extension should not require connections to hundreds of such domains.

The developer attribution [email protected] is a generic Gmail address with no company verification, which is a red flag for extensions with this infrastructure footprint. The extension has 914 users, suggesting some distribution but not enough to assume safety through popularity alone.

Importantly, there are zero malware-signature findings and zero obfuscation findings. The 16 code-smell findings marked as high severity are noise per CVEQ's known false-positive patterns and should not drive the verdict. The absence of malware signatures means we cannot confirm this is actively harmful malware, but the domain patterns strongly suggest adware behavior.

Strongest Counterargument: A skeptic might argue that without observed network traffic (0 network findings) or malware signatures, this could be a poorly designed but benign extension with bundled dependencies. However, the nature of these domains—short tracking-style TLDs like j.cv, o.to, h.to—is fundamentally inconsistent with legitimate wallpaper functionality. Bundled npm dependencies would reference package registries or CDN domains, not hundreds of short tracking domains. The mismatch between declared purpose (live wallpaper) and infrastructure footprint (405+ tracking-style domains) is the core risk indicator here.

Recommendation: This extension should be removed or blocked. The domain patterns are consistent with adware or aggressive tracking, and the anonymous publisher provides no accountability.

Key Reasons

• 405 IoC findings reference short tracking/ad domains (j.cv, o.to, h.to, y.ls) inconsistent with wallpaper functionality
• Anonymous Gmail developer account with no company verification
• No malware signatures or obfuscation prevents confirmed_malicious verdict
• Domain patterns characteristic of adware/tracking infrastructure

False Positive Considerations

• code-smell findings (16 high-severity items are noise per CVEQ patterns)
• IoC count inflation from XIOC extractor
• no malware signatures to confirm malicious intent

Reviewed 2026-05-08; recommended action: escalate; model confidence 85%.