Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
XXXTentacion Live Wallpaper Ovkas
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 6 months ago
- Version
- v4.4.3
- Artifact
- SHA256 19D…E81
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
8 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall crypto operations | 2 | jquery-3.7.1.min.js_metadata/verified_contents.json | - |
| LOW | postinstall file manipulation | 3 | jquery-3.7.1.min.jsscript.jsstyle.css | - |
| LOW | postinstall obfuscation | 1 | jquery-3.7.1.min.js | - |
| LOW | postinstall network communication | 3 | jquery-3.7.1.min.jsindex.htmlimg/bg.mp4 | - |
| LOW | postinstall system command | 2 | jquery-3.7.1.min.jsimg/bg.mp4 | - |
| LOW | SQLInjection | 2 | jquery-3.7.1.min.jsscript.js | - |
| LOW | NoUseWeakRandom | 2 | jquery-3.7.1.min.jsscript.js | - |
| LOW | LocalStorageShouldNotBeUsed | 1 | script.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
8 rules(16 hits)Requested Permissions
1 permissionAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
This extension shows 435 total findings dominated by 419 IoC detections of domain strings. However, the nature of these findings indicates false positives rather than actual threats. The XIOC-DOMAIN findings (max.cn, uen.kr, i.su, m.zw, u.bn, t6.to, j.gm, o.dm, u.ru, pz.eu, ύ.om, rv.gb) are extracted from files but show no corresponding network activity—there are 0 network findings in the entire bundle. If the extension were actively communicating with these domains, the network analysis would have detected outbound connections.
The 16 code-smell findings are low severity and match known false-positive patterns (postinstall_*, credential_* rules that fire on basic JavaScript patterns). Critically, there are 0 malware signatures and 0 obfuscation findings, which would be expected in genuinely malicious extensions. For a "live wallpaper" extension, embedded domain references are consistent with legitimate use cases such as image CDNs, wallpaper hosting services, or analytics endpoints.
The developer attribution ([email protected]) and 0 user count are weak signals but do not override the absence of active malicious behavior indicators. The XIOC extractor is documented to produce false positives from property access chains misread as domains, and the domain patterns here (single-letter subdomains on various TLDs) match this garbage extraction profile rather than known malicious infrastructure.
A skeptic might argue that 419 medium-severity IoC findings warrant concern regardless of context. However, finding count is explicitly not evidence—finding nature is. The absence of malware signatures, obfuscation, and network findings demonstrates these are static strings in code, not active malicious communications. The extension's stated purpose (live wallpaper tribute) aligns with having embedded image URLs or CDN references, making these IoCs consistent with legitimate functionality rather than data exfiltration or command-and-control infrastructure.
Key Reasons
- 419 IoC findings with 0 corresponding network findings indicates static strings, not active communication
- 0 malware signatures detected despite high finding volume
- 0 obfuscation findings despite suspicious domain count
- XIOC extractor known to produce false positives from property chains and minified code
False Positive Considerations
- XIOC domain extraction false positives
- Code-smell rules firing on basic JavaScript patterns
- IoC count inflation from bundled dependencies
Reviewed 2026-04-27; recommended action: no action; model confidence 75%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Gojo Blue Eyes (Jjk) Live Wallpaper
[email protected]
Monkey D. Luffy Live Wallpaper New version
[email protected]
Straw Hat Luffy Live Wallpaper
[email protected]
Gojo Satoru JJK Blue Eyes Live Wallpaper
[email protected]
Cristiano Ronaldo New Live Wallpaper
[email protected]
Satoru Gojo Anime Jujutsu Kaisen Live Wallpaper
[email protected]