BMW M2 Under the Rain Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This BMW M2 live wallpaper extension triggers 722 IoC findings but shows zero malware signatures, zero obfuscation, and no network findings. The extension's stated purpose—displaying rain-soaked BMW M2 imagery as a live wallpaper—is legitimate and aligns with its name and description.

The 722 IoC findings include domains like 0x.ac, h.mu, lr.ms, n.tl, fj.il, 2.sm, d.ch, u.mg, m.ie, w.mh, and la.ac. These short, single-letter domains are characteristic of content delivery networks or asset hosting services commonly used by live wallpaper extensions to serve video/image content. The domain ӽc.af contains a Cyrillic character, which the threat model identifies as a known IoC extractor false positive pattern from hex substrings in minified JavaScript rather than intentional homograph attacks.

The 19 code-smell findings at high severity are classified as code-smell type, which the CVEQ documentation explicitly states should NEVER drive a verdict. These rules match basic JavaScript patterns (fetch, exec, fs, crypto) and are documented noise sources. Critically, there are zero malware signatures and zero obfuscation findings—two of the strongest indicators of actual malicious intent.

The developer uses a Gmail address ([email protected]) rather than a verified company name, which is a minor concern but common for small-scale extensions. The user count of 157 is relatively low but not a strong signal either way.

Counterargument: A skeptic could argue the unusual short-domain list (like h.mu, n.tl, 2.sm) resembles command-and-control infrastructure. However, this argument fails because: (1) there are zero malware signatures despite 741 total findings, (2) there is zero obfuscation which malware authors almost always use, (3) the extension category (live wallpaper) legitimately requires external content hosting, and (4) the IoC extractor is documented to produce massive false-positive volumes from bundled dependencies. The absence of malware signatures and obfuscation is decisive evidence against malicious intent.

Key Reasons

• Zero malware signatures despite 741 total findings
• Zero obfuscation findings—malware authors almost always use obfuscation
• IoC domains appear to be content delivery for wallpaper assets, not C2 infrastructure
• 19 code-smell findings are documented false positive patterns
• Extension purpose (live wallpaper) legitimately requires external content hosting

False Positive Considerations

• IoC extractor garbage from bundled dependencies
• Code-smell rules matching basic JavaScript patterns
• Short domain names from content delivery networks
• Cyrillic character in domain is IoC extractor hex substring false positive

Reviewed 2026-04-30; recommended action: suppress false positive; model confidence 75%.