Frieren Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Frieren Live Wallpaper extension (version 2.20.0) presents 490 total findings but exhibits no indicators of actual malicious behavior. The 471 IoC findings consist entirely of short, nonsensical domains like a.bt, d.pg, n.cf, and w.ly extracted from file contents (file_path: extracted_from_files). These domains follow the classic XIOC false positive pattern: 1-3 character subdomains paired with unusual TLDs (.bt, .aw, .pg, .jo, .sm, .so, .cf, .ly, .cx), with some containing Unicode characters like ߁.aw and ʒ.jo. Critically, there are ZERO network findings, meaning no actual HTTP requests to these domains were detected in the extension's runtime behavior.

The 19 code-smell findings are marked high severity, which is atypical since code-smell rules usually fire at low severity. However, without specific finding titles or file paths, these cannot be distinguished from generic YARA matches on common JavaScript patterns. The complete absence of malware signatures (0), obfuscation findings (0), and network activity (0) strongly indicates these are noise rather than evidence of malicious intent.

The extension's purpose—displaying live wallpaper featuring Frieren, a character from the anime "Frieren: Beyond Journey's End"—is legitimate and matches its description. The developer email [email protected] is generic but not inherently suspicious. The 942 user count suggests moderate adoption without red flags.

Counterargument: A skeptic might argue that 471 IoC findings and 19 high-severity code-smell findings warrant investigation. However, the nature of these findings matters more than their count. The IoC domains are clearly XIOC extraction artifacts (property chains, hex strings, or random sequences from minified/bundled code), not active network destinations. The code-smell findings lack the specificity of actual malware signatures. If this were malicious, we would expect at least one malware signature, obfuscation technique, or actual network communication to a suspicious domain. The absence of all three confirms these are false positives from automated detection tools.

Key Reasons

• 471 IoC findings are XIOC extraction garbage (nonsensical short domains, no network activity)
• Zero malware signatures and zero obfuscation findings
• Zero network findings despite 471 extracted IoC domains
• Extension purpose (anime wallpaper) is legitimate and matches description

False Positive Considerations

• XIOC-DOMAIN extraction garbage
• Generic code-smell YARA rules
• Bundled/minified JavaScript false positives

Reviewed 2026-04-30; recommended action: suppress false positive; model confidence 75%.