Ahri League Of Legends Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension 'Ahri League Of Legends Live Wallpaper' (version 2.0.0) shows 781 total findings, but the nature of these findings reveals a classic false positive pattern. All 756 IoC findings follow an identical pattern: single-character subdomains on obscure country-code TLDs such as 'y.cg', 'x.ua', 'a.ye', 's.hr', 'θ.aw', 'w.zm', 'p.ee', 'y.gl', 'y.kh', 'y.uz', '2.mh', and 't.cv'. This uniform pattern is characteristic of XIOC extractor garbage, where the domain extractor misidentifies hex strings or code patterns as domains. The file_path for all IoC findings is 'extracted_from_files'—a generic placeholder that provides no actionable file location.

Critically, there are zero malware signatures, zero obfuscation findings, and zero network findings in the entire evidence bundle. If this extension were actually communicating with these domains for malicious purposes, we would expect to see network findings showing actual connections, or obfuscation findings hiding the payload. The 25 code-smell findings are classified as low-severity noise according to CVEQ's known false positive patterns—these match basic JavaScript patterns and do not indicate malicious behavior.

The extension's stated purpose—providing League of Legends live wallpapers and new tab experiences—does not require communication with obscure ccTLDs. While the developer attribution is an email address ('[email protected]') rather than a verified company, and the user count is low (265 users), these factors alone do not constitute evidence of malicious intent.

Counterargument: A skeptic might argue that the 756 IoC domains could represent a domain generation algorithm (DGA) or command-and-control infrastructure. However, DGA domains would show variation in structure, and actual C2 infrastructure would trigger network findings showing outbound connections. The complete absence of malware signatures, obfuscation, and network findings makes this interpretation unsupported. The uniform single-character ccTLD pattern is a documented XIOC false positive signature, not a malware indicator. Without evidence of actual malicious behavior beyond IoC volume, the verdict must reflect the finding nature, not the finding count.

Key Reasons

• All 756 IoC findings follow identical single-character ccTLD pattern characteristic of XIOC false positives
• Zero malware signatures detected in the extension
• Zero obfuscation findings despite high finding count
• Zero network findings indicating no actual communication with suspicious domains
• File paths are generic placeholders ('extracted_from_files') rather than specific malicious files

False Positive Considerations

• XIOC domain extractor misidentifying code patterns as domains
• Code-smell YARA rules firing on basic JavaScript patterns
• Bundled dependency code triggering multiplicative IoC matches

Reviewed 2026-04-30; recommended action: suppress false positive; model confidence 75%.