Toyota Supra Mk4 Toji Fushiguro Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality strong.

This Chrome extension "Toyota Supra Mk4 Toji Fushiguro Live Wallpaper" presents 371 total findings, but the nature of these findings reveals they are false positives rather than actual threats.

The 351 IoC findings are all from the XIOC extractor and follow a well-documented false-positive pattern. The detected "domains" such as o.call, i.call, ae.call, 8.mw, 6.ae, j.kh, f.bd, z.ax, hv9.bd, 7u.mo, ot.ng, and d.mc are not legitimate domain names. These match the known XIOC garbage pattern where property access chains in minified JavaScript (like o.call, h.next, g.id) are misread as domain names. The file_path for all IoC findings is extracted_from_files, confirming these were extracted by the XIOC parser rather than detected through actual network activity. Notably, there are zero network findings, which would be present if these were real outbound connections.

The 20 code-smell findings are classified as low severity and match the YARA code-smell noise pattern. These rules (postinstall_*, credential_*, code-quality rules) fire on almost any non-trivial JavaScript and should never drive a verdict per the CVEQ false-positive documentation.

Crucially, there are zero malware signatures, zero malware findings, zero obfuscation findings, and zero network findings. The extension's purpose—a live wallpaper featuring anime content—matches its description. While the developer uses a personal email ([email protected]) rather than a verified company account, this is common for smaller creative extensions and does not indicate malicious intent.

The strongest counterargument would be that 351 IoC findings is a large number that should warrant concern. However, the CVEQ documentation explicitly states that IoC COUNT alone is meaningless and that the XIOC extractor produces massive false-positive volumes. The nature of these findings—single or two-character strings with country-code TLDs that are clearly property access chains—confirms they are garbage extraction artifacts, not real threat indicators. A genuine malicious extension would have at least one specific, non-generic suspicious domain, malware signatures, or actual network findings, none of which are present here.

Key Reasons

• All 351 IoC findings match XIOC false-positive pattern (property access chains misread as domains)
• Zero malware signatures, zero obfuscation, zero network findings
• 20 code-smell findings are known noise patterns that never drive verdicts
• Extension purpose matches description (live wallpaper) with no behavioral anomalies

False Positive Considerations

• XIOC-DOMAIN property access chain extraction
• YARA code-smell rules on basic JavaScript
• IoC count inflation from extractor garbage

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 85%.