Hiyuki Live Wallpaper (Wuthering Waves) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension’s manifest and source files contain no executable code that matches known malware signatures, and no obfuscation patterns were detected. The only findings are a list of domain strings extracted from the package (e.g., s.vg, ce.support, i.support, b.find.id, b.filter.id, oe.flat.call, jquery.org, c.postdispatch.call, f.remove.call, f.add.call, ovkas.com, l.opts.start.call) all reported under the title XIOC‑DOMAIN with the generic file path extracted_from_files. These entries are typical of the XIOC extractor’s tendency to flag any text that resembles a domain name, even when it appears in comments, configuration objects, or as part of third‑party library URLs. None of the findings indicate that the extension actually initiates network connections to these hosts at runtime.

The extension’s description advertises a new‑tab live wallpaper, and the developer identifier is a personal email address rather than a verified organization. This lack of publisher reputation is a minor concern, but it does not by itself imply malicious intent. The absence of any network‑type findings, code‑smell alerts, or obfuscation flags suggests that the package does not contain active payloads that could exfiltrate data, hijack the browser, or serve unwanted ads.

The abundance of domain‑looking strings is most plausibly explained by bundled third‑party assets (e.g., image hosts, analytics endpoints, or library CDN URLs) that are referenced in the extension’s static resources. The presence of a well‑known domain such as jquery.org further supports this benign interpretation, as many front‑end projects include references to the jQuery library’s website.

A skeptic might argue that the sheer number of non‑standard domains (e.g., b.find.id, c.postdispatch.call) indicates hidden tracking or ad‑delivery infrastructure. However, without any corroborating evidence—such as runtime network calls, permission abuse, or code that dynamically constructs URLs—these strings remain inert. The XIOC extractor is known to generate many false positives from minified code and bundled dependencies, and the findings here match that pattern exactly. Therefore, the suspicion that the extension is a PUP or spyware is not substantiated by concrete technical behavior.

In conclusion, the extension does not exhibit any demonstrable malicious capabilities. The detections are artifacts of an over‑aggressive IoC extraction process, and no actionable threat was identified.

Key Reasons

• No malware signatures matched
• No obfuscation or dynamic network behavior observed
• Findings consist solely of static domain strings extracted from files
• Presence of known benign domains such as jquery.org
• Typical false‑positive pattern of the XIOC extractor

False Positive Considerations

• IoC extractor garbage
• No malware signatures
• No obfuscation
• No network behavior

Reviewed 2026-06-02; recommended action: suppress false positive; model confidence 78%.