Netflix Picture in Picture now for Prime & D+ [QVI]

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension is described as a Picture in Picture tool, while its name claims support for Netflix, Prime, and Disney+ services. The available code findings are limited to network detections in js/disney.min.js and js/appletv.min.js, including NET-FETCH-js/disney.min.js-4418 and NET-FETCH-js/appletv.min.js-6825. These file names fit a streaming-site integration, yet the finding records provide no destination URLs or request purpose, so the network behavior cannot be tied to a known service.

The name deserves separate attention. Netflix Picture in Picture now for Prime & D+ [QVI] uses several well-known service names, while the supplied metadata identifies only [email protected] as the developer. That combination does not prove impersonation, since the evidence contains no copied logo, copied description, or direct claim of official ownership. It does make the publisher and brand relationship unclear, especially because the extension has 200,000 users and version 0.2.94.

The code findings themselves do not establish theft or malware. NET-FETCH-js/disney.min.js-4418, NET-FETCH-js/disney.min.js-10089, and the other detections in js/disney.min.js identify fetch-like network activity, with no endpoint shown in their records. NET-FETCH-js/appletv.min.js-6825 gives the same kind of signal in the Apple TV-related file. The supplied results contain no malware-signature, obfuscation, secret, cookie, history, or permission finding associated with those paths. There is also no extracted network endpoint to connect the requests to an ad server, search hijacker, credential service, or proxy network.

A skeptic could say that all 65 network findings are ordinary code from a video-site integration, and the absence of suspicious destinations makes the extension harmless. The file names js/disney.min.js and js/appletv.min.js support that explanation, and minified JavaScript can produce many fetch detections. The available records still omit the URLs and the surrounding code, so they cannot show whether requests serve playback features, telemetry, or unrelated content. The brand-heavy name and anonymous-looking developer address add a separate trust question that network counts cannot settle.

Runtime analysis should capture requests made while opening Netflix, Prime Video, and Disney+ pages, then compare each destination with the service being used. The code around NET-FETCH-js/disney.min.js-4418 and NET-FETCH-js/appletv.min.js-6825 should also be inspected for collection of cookies, page text, credentials, or browsing data. Until those checks identify the destinations and data flow, the evidence supports follow-up rather than a finding of malicious behavior.

Key Reasons

• js/disney.min.js and js/appletv.min.js contain network findings, but their records provide no destination URLs or request context.
• The name Netflix Picture in Picture now for Prime & D+ [QVI] uses multiple major service brands without evidence of official ownership.
• No malware-signature, obfuscation, secret, cookie, or permission finding is tied to the reported files.
• The minified streaming-file names provide a benign explanation for the fetch detections, but the missing request details prevent a firm conclusion.

False Positive Considerations

• Network detections in minified streaming integration files can reflect ordinary fetch calls.
• The network finding records omit destination URLs and request context.
• Multiple detections occur in files named js/disney.min.js and js/appletv.min.js, which may be bundled site-integration code.

Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 72%.