Naruto Kurama Sacred Run Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The manifest is the first thing worth reading. permissions is empty and host_permissions is empty. A new tab wallpaper extension normally reaches out to a server to pull images; this one cannot, because it holds no host access at all. Every pixel it draws has to come from files inside the package.

The 222 indicator hits are the bulk of the scan, and their names give the game away. Take XIOC-DOMAIN-θ.mn, XIOC-DOMAIN-s-.fm, XIOC-DOMAIN-qrs.tc, XIOC-DOMAIN-n.dj. The endpoint list repeats the shape: x.vu, zg.ag, d.sx, 1u.th, 2l.fi, bo.ge, bg.mp, custom.show. Two entries settle the question. 6wyƞט.vc carries a Hebrew letter and b蔩n.bd carries a CJK character. No registrar issues those. What produced them is a string table inside minified JavaScript, where short fragments sit next to dots and punctuation until a hostname regex reads them as domains.

Everything else in the scan is quiet. Malware signatures: zero. Network findings: zero. Obfuscation: zero. Secret findings: zero. Twenty code-smell hits round out the total, and those rules match ordinary JavaScript constructs such as fetch calls and environment variable reads, which turn up in any non-trivial script.

A skeptic would point at the publisher and the genre. The listing credits a gmail address, shows zero users, and belongs to the anime wallpaper new tab category, which has a track record of shipping with search redirects bolted on. That wariness is reasonable. It would matter here if the manifest gave the extension any way to act on it. It does not. No host permissions means no ability to read or rewrite the pages you visit, and no content script permission means no code injected into tabs. The only capability the name implies, replacing the new tab page, is what the listing advertises.

What would change this read? A manifest whose chrome_url_overrides points at a page that submits a search query to one of those hosts, a host_permissions entry listing x.vu, zg.ag or 1u.th, or a network finding naming a resolvable server. None of those is present. The scan ran across every category and produced nothing beyond ioc and code-smell entries.

The finding count reflects the extractor's appetite for short strings in minified code. The real gap in this evidence is the source of the wallpapers; without host permissions they must be packaged, and the scan does not name the files holding them. Listing the packaged image assets and the manifest's chrome_url_overrides key would close that gap in a minute, and neither would change the fact that no finding in this scan shows the extension contacting anything.

Key Reasons

• All 222 ioc hits are two-to-three character pseudo-domains, including entries with Hebrew and CJK characters (6wyƞט.vc, b蔩n.bd) that no registrar issues, consistent with minified JavaScript string fragments misread as hostnames.
• Zero malware-signature, network, obfuscation, dependency and secret findings across every scanned category.
• Empty permissions and host_permissions leave no mechanism to read visited pages or fetch remote content.
• The remaining twenty hits are code-smell rules that match ordinary JavaScript constructs such as fetch and environment variable access.

False Positive Considerations

• XIOC extractor parsing minified JavaScript string tables as domain names
• Non-ASCII characters inside claimed domains (θ.mn, 6wyƞט.vc, b蔩n.bd) showing the extracted strings are not real hostnames
• YARA code-smell rules firing on ordinary JavaScript
• Finding count inflated by ioc volume despite zero malware, network or obfuscation findings

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 82%.