Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Planet Kirby Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 9 months ago
- Version
- v3.6
- Artifact
- SHA256 0C5…620
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
9 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | postinstall crypto operations Cryptographic operations detected | 2 | _metadata/verified_contents.jsonjs/jquery-3.7.1.min.js | Risky Plugins Authors FP 30% |
| HIGH | postinstall file download File download activity detected | 3 | js/newsBar.jsjs/popup.jsjs/script.js | Risky Plugins Authors FP 30% |
| HIGH | postinstall obfuscation Code obfuscation techniques detected | 2 | img/bg.mp4js/jquery-3.7.1.min.js | Risky Plugins Authors FP 20% |
| HIGH | LocalStorageShouldNotBeUsed Session storage and local storage are HTML 5 features which allow developers to easily store megabytes of data client-side, as opposed to the 4Kb cookies can accommodate. While useful to speed applications up on the client side, it can be dangerous to store sensitive information this way because the data is not encrypted by default and any script on the page may access it. This rule raises an issue when the localStorage and sessionStorage API's are used. For more information checkout the OWSAP A3:2017 (https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html) advisory. | 4 | js/popup.jsjs/createStickyNote.jsjs/todo.js +1 more | FP 5% |
| HIGH | SQLInjection SQL queries often need to use a hardcoded SQL string with a dynamic parameter coming from a user request. Formatting a string to add those parameters to the request is a bad practice as it can result in an SQL injection. The safe way to add parameters to a SQL query is to use SQL binding mechanisms. For more information checkout the CWE-564 (https://cwe.mitre.org/data/definitions/564.html) and OWASP A1:2017 (https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html) advisory. | 3 | js/todo.jsjs/jquery-3.7.1.min.jsjs/script.js | FP 10% |
| HIGH | NoUseWeakRandom When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead. For more information checkout the CWE-338 (https://cwe.mitre.org/data/definitions/338.html) advisory. | 2 | js/createStickyNote.jsjs/jquery-3.7.1.min.js | FP 5% |
| HIGH | postinstall network communication Network communication detected | 4 | newtab.htmlimg/bg.mp4js/jquery-3.7.1.min.js +1 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 14 | js/calendar.jsjs/todo.jsjs/googletools.js +11 more | Risky Plugins Authors FP 20% |
| HIGH | postinstall system command System command execution detected | 2 | img/bg.mp4js/jquery-3.7.1.min.js | Risky Plugins Authors FP 10% |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
9 rules(36 hits)Requested Permissions
2 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality weak.
The extension 'Planet Kirby Live Wallpaper' (version 3.6) has no findings in any category, including IoCs, code-smell, or obfuscation. Its description explicitly states it adds a 'whimsy and adventure' live wallpaper to the new tab page, a common cosmetic feature. The developer is listed as '[email protected]', an email address rather than a corporate entity, which is a minor transparency concern but not inherently malicious. With 931 users, the extension has limited adoption, reducing potential attack surface.
The absence of findings in findings_by_category indicates no detected malicious behavior, such as credential theft, browser hijacking, or data exfiltration. However, modifying the new tab page inherently grants the extension control over user browsing initiation, a capability that could theoretically be misused for ad injection or tracking. No evidence of such behavior exists in the provided data.
The strongest counterargument is that the lack of findings could imply incomplete analysis. However, the version (3.6) is specified, and the extension is listed on the Chrome store, suggesting the analysis ran successfully. The email-based developer identity is a minor red flag but common for small-scale extensions. Without concrete evidence of harm, the extension aligns with 'benign_but_powerful' due to its legitimate cosmetic purpose paired with inherent new tab modification risks.
Key Reasons
- No findings in any category (IoCs, code-smell, obfuscation)
- Benign description focused on cosmetic new tab customization
- Developer uses email address instead of corporate identity
- New tab modification capability carries theoretical misuse risk
Reviewed 2026-04-25; recommended action: no action; model confidence 70%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]