Automobile vehicle sports car live wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

This extension presents genuinely mixed signals that prevent a definitive verdict. The extension 'Automobile vehicle sports car live wallpaper' is published by [email protected], an anonymous email address with no verified publisher identity. This alone is a red flag given the threat model's emphasis on developer attribution.

The 778 IoC findings are dominated by domain detections including qu.ac, ǃ.nl, p.gw, e.do, d.nr, q.cx, r.ls, 7.se, u.az, and fy5.bm. These domains exhibit suspicious patterns: extremely short subdomains, unusual TLDs, and notably ǃ.nl contains a non-ASCII exclamation mark character that could indicate IDN homograph techniques. For a 'live wallpaper' extension, fetching from 778 different domains is atypical and warrants scrutiny.

However, the evidence lacks critical malicious indicators. There are zero malware-signature findings and zero malware findings, meaning no actual malware was detected. There are also zero obfuscation findings, which would be expected if the developer were attempting to hide malicious behavior. The two network findings (NET-FETCH-js/script.js-17 and NET-FETCH-js/popup.js-35) are basic fetch calls that could legitimately serve wallpaper content.

The 21 code-smell findings appear to be low-severity patterns that the threat model explicitly classifies as noise, matching basic Node.js patterns rather than actual malicious code.

The strongest counterargument to this verdict is that the 778 IoCs represent false positives from the XIOC extractor, which the threat model notes produces massive false-positive volumes. A skeptic could argue these are legitimate CDN or content domains for wallpaper images. However, the specific domain patterns (especially ǃ.nl with the special character) are not generic infrastructure domains like googleapis.com or cloudflare.com, and the sheer volume for a wallpaper extension is unusual. Runtime analysis would definitively show whether these domains serve wallpaper content or ads/tracking.

Without malware signatures, obfuscation, or credential theft evidence, I cannot confirm malicious intent. But the anonymous developer combined with suspicious domain patterns creates significant uncertainty that requires further investigation.

Key Reasons

• Anonymous developer (email only, no verified publisher)
• 778 IoC findings across unusual short domains
• No malware signatures detected
• No obfuscation detected
• Domain pattern (ǃ.nl with special character) is suspicious

False Positive Considerations

• XIOC domain extraction false positives
• code-smell findings classified as noise
• high IoC count from content fetching

Reviewed 2026-04-30; recommended action: runtime analysis; model confidence 70%.