Anime Akame Ga Kill! Live Wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

The extension Anime Akame Ga Kill! Live Wallpaper advertises itself as a new‑tab wallpaper changer, and its manifest does not contain any malicious signatures, obfuscation, or credential‑stealing code. However, the XIOC extractor identified sixteen distinct external domains (e.g., ce.support, i.support, b.find.id, jquery.org, v.events) across the scanned files. These domains are not part of any known CDN, analytics service, or the extension’s own hosting infrastructure, and they do not correspond to the anime‑related content the extension claims to serve. Their presence suggests that the new‑tab page loads resources or telemetry from these third‑party endpoints, a pattern typical of ad‑ware that injects promotional content or tracks user activity.

No findings indicate that the extension accesses cookies, reads passwords, or modifies browsing settings beyond the new‑tab page. The absence of malware‑signature, obfuscation, and code‑smell detections means the code itself is not deliberately hidden or maliciously crafted. The risk stems primarily from the external network contacts, which could be used to serve ads, collect usage data, or download additional payloads without user consent.

The extension’s developer is listed only as an email address ([email protected]) with no reputable publisher attribution, and the user count is reported as zero, which together raise concerns about oversight and maintenance. Nevertheless, the behavior stops short of credential theft, browser hijacking, or proxyware, so the threat is best categorized as ad‑ware that may degrade user experience and privacy.

Counterargument: A skeptic might argue that the listed domains are benign analytics or CDN hosts included inadvertently by a bundled UI library, and that the sheer number of findings is merely a by‑product of the XIOC extractor’s known false‑positive rate. While it is true that some domains (e.g., jquery.org) are legitimate, the majority (ce.support, i.select, b.filter.id, ke.td, v.events) are obscure and lack any public association with standard web libraries. Their collective appearance across multiple files, combined with the extension’s sole function of delivering visual content, points to purposeful external loading rather than incidental library references.

In conclusion, the extension does not contain overt malware, but its pattern of contacting numerous obscure domains from a new‑tab page replacement warrants a confirmed risk rating. Users should be aware that installing this extension could expose them to unsolicited advertising or hidden telemetry.

Key Reasons

• Multiple unknown external domains contacted (e.g., ce.support, i.select, b.find.id)
• No malware signatures or obfuscation detected
• Extension functions as a new‑tab wallpaper replacer, a common ad‑ware vector
• Developer listed only as an email with no verified publisher

Reviewed 2026-05-31; recommended action: monitor; model confidence 77%.