Torii Gate Sakura Blood Moonlight Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This live wallpaper extension presents 649 total findings, but the nature of these findings indicates false positives rather than actual malicious behavior. The 625 IoC findings (XIOC-DOMAIN-yz.gh, XIOC-DOMAIN-i.cd, XIOC-DOMAIN-d.ml, etc.) are characteristic of the XIOC extractor's known false-positive patterns. These short domains with unusual TLDs (.gh, .cd, .ml, .yt, .je, .ni, .cl, .ci, .cg, .ss, .me) are likely embedded strings from bundled dependencies or configuration files rather than active network destinations.

Critically, the extension has ZERO malware signatures and ZERO obfuscation findings. If this were actually malicious code communicating with command-and-control infrastructure, we would expect to see malware-family YARA signatures or obfuscation techniques to hide the payload. The absence of these high-confidence threat indicators strongly suggests the IoC findings are extraction artifacts.

The network findings show only 2 detections: NET-FETCH-js/popup.js-35 indicates a standard fetch call in the popup interface, which is expected behavior for any extension that needs to load content or check for updates. This minimal network activity does not align with the 625 IoC claims and suggests the IoCs are not being actively contacted.

The developer attribution ([email protected]) is an email address rather than a verified company, and the user count (300) is low. However, these factors alone do not constitute evidence of malicious intent. The extension's stated purpose (live wallpaper with Torii Gate, Sakura, Blood Moonlight themes) is consistent with its behavior profile.

The strongest counterargument would be that 625 IoC findings cannot be dismissed as noise. However, the CVEQ guidelines explicitly state that IoC COUNT alone is meaningless and that bundled dependencies create multiplicative false positives. The absence of malware signatures, obfuscation, and suspicious network behavior patterns (no browser hijacking, no credential theft indicators, no proxyware functionality) makes the malicious verdict untenable. The 22 code-smell findings are also classified as low-severity noise per the false-positive patterns documentation.

This extension should be suppressed as a false positive, though the unverified developer warrants basic monitoring.

Key Reasons

• Zero malware signatures despite 649 total findings
• Zero obfuscation findings
• IoC domains do not match active network calls (only 2 fetch detections)
• XIOC extractor known to produce false positives from bundled dependencies
• Extension behavior consistent with stated wallpaper functionality

False Positive Considerations

• XIOC-DOMAIN extraction noise
• Bundled dependency IoC multiplicity
• Code-smell findings (low severity noise)
• IoC count inflation without malware signatures

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 85%.