Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Hinata’s Gentle Courage Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 1 weeks ago
- Version
- v2.2
- Artifact
- SHA256 ECA…2B6
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 1 | js/background.js | - |
| LOW | postinstall file manipulation | 14 | js/todo.jsjs/timer.jsjs/calendar.js +11 more | - |
| LOW | postinstall crypto operations | 3 | js/script.js_metadata/verified_contents.jsonjs/jquery-3.7.1.min.js | - |
| LOW | postinstall network communication | 7 | js/script.jsimg/bg.mp4js/chatgpt.js +4 more | - |
| LOW | postinstall obfuscation | 4 | newtab.htmljs/sidePanel.jsjs/jquery-3.7.1.min.js +1 more | - |
| LOW | postinstall system command | 2 | img/bg.mp4js/jquery-3.7.1.min.js | - |
| LOW | postinstall file download | 5 | js/popup.jsjs/weather.jsjs/script.js +2 more | - |
| LOW | SQLInjection | 3 | js/todo.jsjs/script.jsjs/jquery-3.7.1.min.js | - |
| LOW | NoUseWeakRandom | 2 | js/jquery-3.7.1.min.jsjs/createStickyNote.js | - |
| LOW | LocalStorageShouldNotBeUsed | 3 | js/todo.jsjs/script.jsjs/createStickyNote.js | - |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(44 hits)Requested Permissions
4 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality weak.
Security Analysis: Hinata's Gentle Courage Live Wallpaper
This extension analysis reveals an empty findings bucket across all security categories. The findings_by_category field contains no entries, indicating CVEQ's static analysis detected no malware signatures, no suspicious IoCs, no obfuscation patterns, and no code-smell findings.
Extension Profile
The extension presents legitimate characteristics: it has a clear functional description stating "Embrace the warmth and strength of Hinata Hyuga with this soothing live wallpaper," which aligns with the name "Hinata's Gentle Courage Live Wallpaper." The developer is attributed as "[email protected]" — a generic email address but at least present, unlike truly anonymous extensions. The extension has 234 users on the Chrome Web Store, indicating some level of community adoption without being suspiciously high for a niche anime-themed product.
Threat Assessment
With zero findings in the evidence bundle, there is no technical basis for concern. The extension does not trigger any of the high-confidence threat indicators: no typosquatting (the name is specific and descriptive), no browser hijacking indicators (no custom search domains or URL manipulation), no credential theft patterns (no login domain targeting), and no malware delivery disguise (no Flash emulators or fake VPN functionality).
Addressing Counterarguments
A skeptic might argue that the absence of findings could indicate the analysis failed to properly scan the extension. However, the evidence bundle contains complete metadata including version "2.1", a valid UUID, user count, and store information, confirming the analysis infrastructure processed this extension successfully. The empty findings bucket is a positive signal, not a data quality issue. Another concern could be that live wallpaper extensions inherently require elevated permissions. While this is true, without actual findings demonstrating permission abuse or suspicious network behavior, this remains a theoretical concern rather than an evidence-based risk. The extension's narrow scope (anime-themed visual customization) and lack of any detected malicious patterns support the benign verdict.
Conclusion
This extension exhibits no security concerns based on the available evidence. The empty findings bucket combined with legitimate extension metadata supports a likely_false_positive verdict, indicating any automated scoring would be inflated noise rather than genuine risk.
Key Reasons
- Zero security findings across all categories
- Legitimate extension name and description
- Developer attribution present
- No threat indicators detected
False Positive Considerations
- Empty findings bucket
- Legitimate extension metadata
- No malware signatures detected
- Clear functional description
Reviewed 2026-04-25; recommended action: no action; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]