Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Lucilla Wuthering Waves Live Wallpaper
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 4 months ago
- Version
- v14.4.1
- Artifact
- SHA256 604…409
- Source
- Findings (non-IoC)
No Findings
All security checks passed
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
No Threats Detected
This extension passed all security checks
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
The extension "Lucilla Wuthering Waves Live Wallpaper" presents a textbook false positive pattern. All 255 findings are XIOC domain detections, but these domains follow a pattern characteristic of parser artifacts rather than real network activity.
The detected domains include g.ee, c.gn, w.ch, f.lb, g.me, and n.gi — all single-character subdomains with various TLDs. These match the known XIOC false positive pattern where property access chains in minified JavaScript get misread as domain names. For example, code like g.element or c.group gets parsed as g.ee or c.gn. Domains containing non-ASCII characters like ň.ht, ԛ-.ht, and ӛ.ao are almost certainly parsing artifacts from minified or bundled code, not legitimate network destinations.
Critically, there are zero malware signatures detected, zero obfuscation findings, zero network findings, and zero code-smell findings. If this extension were actually malicious, we would expect to see at least some corroborating evidence in these categories. The complete absence of malware signatures combined with the uniform pattern of IoC findings strongly indicates these are false positives from the XIOC extractor.
The developer identity ([email protected]) is anonymous, and the extension has zero users. While these are not positive signals, they are also not definitive indicators of malice. Many legitimate extensions have anonymous developers or low adoption, especially new or niche extensions.
A skeptic might argue that 255 findings of any kind warrant investigation. However, finding count is not evidence — finding nature is evidence. These 255 findings all follow the same documented false positive pattern, and without corroborating evidence from malware signatures, obfuscation, or actual network exfiltration behavior, they should be suppressed as known XIOC false positives. The extension's stated purpose (live wallpaper for new tab) is consistent with a benign cosmetic extension, and no findings contradict this behavior.
Key Reasons
- All 255 findings are XIOC domain false positives matching known FP patterns
- Zero malware signatures detected
- Zero obfuscation findings
- Zero network exfiltration findings
- Domain patterns indicate property access chain parsing artifacts
False Positive Considerations
- XIOC property access chain parsing artifacts
- Non-ASCII domain false positives from minified code
- Single-character subdomain domain patterns
- Zero corroborating malware or network findings
Reviewed 2026-06-04; recommended action: suppress false positive; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Hiyuki Silent Snowstorm (Wuthering Waves) Live Wallpaper
[email protected]
Hiyuki The First Strike (Wuthering Waves) Live Wallpaper
[email protected]
Sukuna: The Four-Armed Manga King Live Wallpaper
[email protected]
One Piece Brook: Music Under the Moonlight Live Wallpaper
[email protected]
Zoro: Three Swords Across the Years Live Wallpaper
[email protected]
Tony Tony Chopper: Little Reindeer Live Wallpaper
[email protected]