Rilakkuma and Friends Duck Car Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Rilakkuma and Friends Duck Car Live Wallpaper is version 1.1.2 on the Chrome Web Store, published under the contact address [email protected]. Its manifest declares no permissions and no host permissions. That caps what it can do: without tabs, cookies, history or any host permission, it has no path to your logged-in sessions at mail, banking or social sites, and no way to read the pages you visit.

Every finding in the scan is a medium-severity network fetch, six in total: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. The file names map onto the stated product. js/weather.js:49 is the call behind the weather readout. js/popup.js:39 loads data for the popup. The three in js/background.js are the wallpaper and update requests. Alongside those, the scan logged no IoCs, no malware signatures, no dependency matches, no secrets and no code-smell hits, so there is nothing here that resembles a payload, a loader or a domain harvest.

A fetch finding tells you a script talks to the network. It does not tell you where. The scan recorded no endpoint domains for this extension, so the destination of those six calls is not established by the evidence. Closing that gap is the only useful next step: pull the URLs out of js/background.js at lines 63, 82 and 96 and confirm they point at an image or weather host rather than an unknown collector.

The strongest counterargument is that a wallpaper extension fetching from a background script is exactly the shape a telemetry or remote-config channel would take, and the publisher is an email address rather than a verified company. That reading would matter if the calls sat next to capability. They do not. With no permissions, no content script injection findings, and four short readable files (background.js, popup.js, sidePanel.js, weather.js), the extension has no mechanism to collect browsing data even if it wanted to. Live wallpaper and weather features cannot work without network calls, so the six fetches are the feature, not a hidden behaviour.

What would change this verdict: an endpoint in js/background.js belonging to neither a weather service nor an image host, a later version adding host permissions or remote script loading, or obfuscation appearing in the background script. None of those are present at 1.1.2.

Key Reasons

• No permissions and no host permissions in the manifest, so no access to cookies, tabs, history or page content
• All six findings are network fetch calls inside the extension's own scripts (js/background.js, js/popup.js, js/sidePanel.js, js/weather.js) matching the wallpaper and weather features
• Zero IoCs, malware signatures, obfuscation, secret or dependency findings
• Source files are short and readable, with no injected script or remote loader identified
• Fetch destinations were not extracted, leaving the one open question about where the calls go

False Positive Considerations

• NET-FETCH rules fire on any XMLHttpRequest or fetch call, including a weather lookup
• Findings carry empty descriptions and no endpoint domains, so severity reflects call presence rather than destination
• No capability findings exist to cross-reference the network activity against

Reviewed 2026-10-18; recommended action: monitor; model confidence 74%.