Sung Jinwoo Solo Leveling Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This is a Chrome new tab extension that plays a live HD wallpaper of Sung Jinwoo from Solo Leveling and adds a small weather panel, published as version 2.2.2 by [email protected] with roughly 8,000 users. The manifest data shows no host permissions and no API permissions. A wallpaper has no reason to read cookies, tabs, or browsing history, and this extension does not ask for any of them.

Six findings, all in the network category and all medium severity. Every one is a fetch call site: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82 and NET-FETCH-js/background.js-96 in the service worker that loads wallpaper assets, NET-FETCH-js/popup.js-39 in the popup, NET-FETCH-js/sidePanel.js-362 in the side panel, and NET-FETCH-js/weather.js-49 in the weather module that retrieves a forecast. The file names line up with the store description. No malware signature matched, no IoC was extracted, no obfuscation was detected, and no bundled dependency alerts fired. The extracted endpoint list is empty, so the scan did not record which hosts those six calls reach.

A fetch finding on its own means the code makes an outbound request. That is how this extension gets a video stream and a temperature reading. What would change this read is a named destination that is not a CDN, an image host, or a weather API.

The strongest argument against this verdict is that six unattributed outbound calls from an extension whose publisher is a bare email address is the shape data collection takes. Add the empty permission lists, which a stricter reading treats as missing manifest data instead of a clean bill of health. Both points are fair, and both run into the same wall: nothing in the scanned code does anything with the responses except render them. There is no cookie access to pair with those requests, no credential handling, no code that reads page content, and no third-party domain in the findings to point at. The network findings are also spread across four files that each map to a visible feature, which is what you expect from a wallpaper with a weather widget and not from a payload.

If the destination hosts turn out to include a tracking or data-broker domain, that would move this assessment. With the current evidence nothing supports it.

Key Reasons

• All six findings are fetch call sites in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, each mapping to a visible wallpaper or weather feature
• No malware signatures, IoCs, obfuscation, dependency alerts, or tool-poisoning indicators matched
• The extension declares no permissions and no host permissions, so it has no access to cookies, tabs, or page content
• File names and store description agree: a new tab wallpaper with a weather panel needs outbound requests

False Positive Considerations

• NET-FETCH findings flag any fetch call site without naming a destination host
• Wallpaper asset delivery and weather lookups require outbound requests by design
• No malware signature, IoC, or obfuscation evidence accompanies the network findings

Reviewed 2026-10-14; recommended action: monitor; model confidence 72%.