Itachi Uchiha Crimson Moon Genjutsu Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension is a new tab wallpaper changer, and its manifest declares no permissions and no host permissions. That is the single most useful fact in the scan. With no permission strings attached, the extension has no access to cookies, tabs, history, bookmarks or page content. Overriding the new tab page is a manifest key rather than a permission, so an empty permission list is what a working wallpaper extension of this shape looks like.

The 154 IoC findings are the bulk of the scan, and each one I can inspect is an extractor artifact. The list contains XIOC-DOMAIN-fd.dk, XIOC-DOMAIN-g.gg, XIOC-DOMAIN-r.co, XIOC-DOMAIN-l.nc, XIOC-DOMAIN-e.hr and XIOC-DOMAIN-rj.co. Those are two-letter fragments of minified JavaScript read as country-code domains. It also contains XIOC-DOMAIN-å.gs, XIOC-DOMAIN-孁t.mp and the endpoint dvݧݻ.hn, where mangled bytes have been mistaken for hostnames. The network endpoint list repeats the same pattern with 0c.vi, 0e.sd, 9bʻ.ky, bп.sk and f0.ni. None of those are real services. The recognisable links are XIOC-URL-https://x.com and XIOC-URL-https://haberikra.com/?p=14776?utm_source=haberikra&utm_medium=haberikra, a social profile and a news article.

The remaining 20 findings are low-severity code-smell. Those rules match ordinary JavaScript patterns and the platform's own guidance treats them as noise. No malware signature matched. No obfuscation was detected. No network finding fired. Nothing came back in the secret, dependency or tool-poisoning buckets.

A skeptic has a fair point. The publisher is an anonymous Gmail address, the install count is zero, and the store description is written in hype. Wallpaper and new-tab extensions have a history of quietly redirecting the search box, and a garbage IoC list would not reveal that. But a new tab hijack needs a redirect endpoint, and the endpoint list here resolves to nothing. It also needs host permissions to rewrite pages, and none are declared. Every IoC reports its source as "extracted_from_files", so we cannot tell which file produced them. The honest read is that the extractor ran over bundled or minified wallpaper code and emitted its usual fragments.

Key Reasons

• Every one of the 154 IoC hits is an extractor artifact: two-letter TLD fragments (XIOC-DOMAIN-fd.dk, XIOC-DOMAIN-g.gg, XIOC-DOMAIN-r.co) and mangled UTF-8 strings (XIOC-DOMAIN-孁t.mp, dvݧݻ.hn).
• The manifest declares no permissions and no host permissions, leaving no API surface for cookie, tab, history or content access.
• Zero malware signatures, zero obfuscation, zero network findings and zero manifest findings across 174 total findings.
• The 20 remaining hits are low-severity code-smell, the documented noise class that matches ordinary JavaScript.

False Positive Considerations

• XIOC extractor splitting minified JavaScript into false domains and URLs
• Low-severity code-smell rules matching ordinary JavaScript constructs
• Mangled UTF-8 byte sequences misread as hostnames
• Finding count inflated by one garbage domain list with no source file attribution

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 80%.