Hiyuki Red Horizon (Wuthering Waves) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

This extension — a live wallpaper for Chrome's new tab page themed around a video game character — has 99 findings, all of them IoC detections. None are malware signatures, obfuscation findings, code-smell triggers, or network-detections. The finding breakdown matters: malware-signature:0, malware:0, obfuscation:0, network:0, code-smell:0. Every single finding is an XIOC domain extraction artifact, and the specific domains confirm this. The majority are clearly JavaScript property-access chains misparsed as domains: v.beforesend.call, finish.call, r.stop.call, r.old.call, f.remove.call, l.opts.fail, and a.empty.fire are all recognizable patterns from minified or bundled JavaScript where chained method calls (e.g., obj.method.call()) are split by the XIOC extractor at each dot boundary. The two legitimate domains — www.instagram.com and www.netflix.com — are expected references in a wallpaper extension that may embed social media links or streaming content. The remaining entries like ce.now, t.fail, and bg.mp follow the same pattern of fragmented property names.

The extension's description as a live HD video wallpaper is consistent with high IoC counts: such extensions typically bundle third-party media libraries and iframe embed code, each contributing minified JavaScript that fragments into property-access false positives. No source files were individually identified — every finding routes to the generic extracted_from_files path, which is consistent with bulk scanning of bundled dist/ output.

A skeptic might note the extension has 0 users and an unverified developer email ([email protected]), raising questions about legitimacy. However, a new extension from an individual developer with no malware signatures, no obfuscation, no network exfiltration signals, and no code-smell findings — only XIOC garbage — does not meet the threshold for confirmed_risk. The absence of malware signatures and obfuscation is decisive: real malicious extensions consistently trigger both. The risk score inflated by 99 IoC findings is a known scoring bias artifact.

This extension should remain available with continued monitoring. If updated, a reanalysis focused on post-update file changes would be prudent.

Key Reasons

• All 99 findings are XIOC IoC false positives (minified code property chains, not real domains)
• Zero malware signatures, zero obfuscation findings, zero network findings, zero code-smell findings
• No suspicious or unknown domains — 'beforesend.call', 'stop.call', 'remove.call' are clearly JS artifacts

False Positive Considerations

• XIOC property access chain fragmentation (e.g., 'v.beforesend.call', 'r.stop.call')
• Bundled minified dependency code generating high IoC volume
• 99 garbage IoCs inflating risk score without any real threat indicators
• Legitimate domains (instagram.com, netflix.com) in a media/wallpaper context

Reviewed 2026-06-02; recommended action: suppress false positive; model confidence 88%.