Kaiju No.8 Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension shows classic CVEQ false positive patterns with no evidence of actual malicious behavior. The 273 IoC findings are entirely from the XIOC extractor misclassifying JavaScript property access chains as domains. Every single IoC finding—such as XIOC-DOMAIN-d.call, XIOC-DOMAIN-f.remove.call, XIOC-DOMAIN-ce.event.handlers.call, and XIOC-DOMAIN-this.show—matches the documented false positive pattern where code like d.call() or ce.event.handlers.call() is incorrectly parsed as a domain name. These are not real network destinations.

The findings summary shows zero malware signatures ("malware-signature":"0"), zero obfuscation findings ("obfuscation":"0"), and zero network findings ("network":"0"). The 16 code-smell findings are low-severity matches against rules like postinstall_* and credential patterns that trigger on basic JavaScript operations, which the CVEQ documentation explicitly classifies as noise. There is no evidence of credential theft, browser hijacking, proxyware, or data exfiltration.

The extension's purpose—a live wallpaper for Kaiju No. 8 anime content—is a legitimate category. The developer uses a generic Gmail address ([email protected]), which is not a verified publisher but also not inherently suspicious for smaller extensions. The user count of 207 is relatively low, which is consistent with a niche anime wallpaper extension.

The strongest counterargument would be the high finding count (289 total) and the anonymous Gmail developer. However, finding count alone is meaningless per CVEQ's own documentation, which states that IoC volume and code-smell counts disproportionately inflate scores. The nature of these findings—not their quantity—determines the verdict. Every finding here matches a known false positive pattern: property access chains misread as domains, code-smell rules firing on standard JavaScript, and no actual malware signatures or obfuscation. A skeptic would need to show at least one genuine suspicious domain, one malware signature, or one obfuscation pattern to challenge this verdict. None exist in this evidence bundle.

Key Reasons

• All 273 IoC findings are XIOC false positives from property access chains (d.call, f.remove.call, ce.event.handlers.call)
• Zero malware signatures detected
• Zero obfuscation findings
• Zero network findings
• Code-smell findings match known benign patterns

False Positive Considerations

• XIOC property access chain false positives
• Code-smell rules on standard JavaScript
• No malware signatures
• No obfuscation patterns

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 85%.