Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Car lights luxury live wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 6 days ago
- Version
- v2.1.1
- Artifact
- SHA256 D99…512
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 1 | js/background.js | - |
| LOW | postinstall file manipulation | 14 | js/countdownTimer.jsjs/calculator.jsjs/popup.js +11 more | - |
| LOW | postinstall crypto operations | 3 | js/jquery-3.7.1.min.js_metadata/verified_contents.jsonjs/script.js | - |
| LOW | postinstall network communication | 7 | js/jquery-3.7.1.min.jsimg/bg.mp4newtab.html +4 more | - |
| LOW | postinstall obfuscation | 4 | newtab.htmljs/background.jsjs/jquery-3.7.1.min.js +1 more | - |
| LOW | postinstall system command | 2 | img/bg.mp4js/jquery-3.7.1.min.js | - |
| LOW | postinstall file download | 5 | js/script.jsjs/weather.jsjs/popup.js +2 more | - |
| LOW | SQLInjection | 3 | js/script.jsjs/todo.jsjs/jquery-3.7.1.min.js | - |
| LOW | NoUseWeakRandom | 2 | js/createStickyNote.jsjs/jquery-3.7.1.min.js | - |
| LOW | LocalStorageShouldNotBeUsed | 3 | js/script.jsjs/todo.jsjs/createStickyNote.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(44 hits)Requested Permissions
4 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality absent.
The "Car lights luxury live wallpaper" extension presents an unusual case in CVEQ triage: the findings_by_category field is completely empty ({}), indicating zero security findings across all categories. This absence of malware signatures, IoC detections, code-smell alerts, or obfuscation flags is itself significant evidence. The extension's metadata shows a straightforward purpose: the description field states it will "Transform your new tab with the mesmerizing Car Lights Luxury Live Wallpaper," which aligns with legitimate new tab customization tools. The developer_name field shows "[email protected]," an email address rather than a company name, a common pattern for smaller, independent extensions. With user_count of 338 and version "2.1.0," the extension appears to be a legitimate, actively maintained product.
The empty findings_by_category is the strongest signal here. In CVEQ's threat model, malicious extensions typically trigger multiple finding categories: malware signatures in suspicious code, IoCs for network communication, code-smell for obfuscation patterns, or impersonation indicators for typosquatting. None of these are present. The extension's name field does not mimic any well-known extension (no typosquatting of "Dark Reader," "uBlock," or similar), and the description field clearly states its wallpaper functionality without misleading claims.
A skeptic might argue that empty findings could indicate incomplete analysis rather than a clean extension. However, the metadata fields are all populated: version is "2.1.0" (not "unknown"), user_count is 338 (not zero), and a complete description exists. If the analysis hadn't run, we would expect either missing metadata or a "version": "unknown" indicator per CVEQ's incomplete_data criteria. The populated fields suggest the analysis completed successfully and found nothing concerning. Additionally, the extension's simple, declarative purpose (new tab wallpaper) doesn't require complex functionality that would typically trigger code-smell or network findings.
Given the complete absence of security findings, the legitimate-sounding functionality, and the populated metadata indicating successful analysis, this extension appears to be a false positive flag in CVEQ's system. The recommended action is no_action, as there is no evidence of malicious behavior or security risk.
Key Reasons
- Zero security findings across all categories (findings_by_category is empty)
- Legitimate new tab wallpaper functionality per description field
- No typosquatting or impersonation indicators in name field
- Populated metadata (version 2.1.0, user_count 338) indicates successful analysis
False Positive Considerations
- Empty findings_by_category indicates no actual security concerns detected
- Simple, legitimate new tab wallpaper functionality
- No malware signatures or suspicious code patterns
- Legitimate-sounding name and description
Reviewed 2026-04-26; recommended action: no action; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]