One Piece Black And White With Luffy's Crew Live Wallpaper

AI Security Review

Evidence context: threat category pup; evidence quality moderate.

This Chrome extension presents significant risk indicators despite lacking malware signatures. The extension 'One Piece Black And White With Luffy's Crew Live Wallpaper' by developer [email protected] contains 369 IoC findings, all classified as medium-severity domain detections.

The IoC domains exhibit clear adware/pup patterns: ovkas.com, d.gi, h.tk, c.th, s.lv, q.tc, y.mn, h.dm, xj.eu, q.km, and r.py. These domains share characteristics inconsistent with legitimate content delivery: short random subdomains (d., h., c., s., q., y.), unusual TLDs (.tk, .dm, .km, .py, .mn, .th, .tc, .lv, .gi), and one domain containing a non-ASCII character (铔lf.ie). These do not match known CDN patterns like googleapis.com, gstatic.com, or cloudflare.com that would be expected for a legitimate wallpaper extension.

The extension claims to provide 'live wallpapers' for Chrome, which is technically unusual since Chrome does not natively support live wallpapers. This functionality typically indicates a new tab page replacement or overlay mechanism—common PUP techniques used to inject advertisements or redirects.

The developer attribution is a generic Gmail address ([email protected]) with no company verification, and the extension has only 12 users. The 16 code-smell findings are low-severity and represent expected noise from standard JavaScript patterns, not malicious behavior. Counterargument: A skeptic could argue that 369 IoCs might stem from bundled dependencies or legitimate content delivery networks. However, this explanation fails because the detected domains do not match any known CDN infrastructure, analytics services, or legitimate content providers. The domain pattern—random subdomains paired with high-risk TLDs like .tk and .dm—is characteristic of adware distribution networks, not legitimate software dependencies. The absence of malware signatures does not rule out PUP behavior; many potentially unwanted programs distribute ads and redirects without triggering traditional malware YARA rules. The evidence points to adware/pup functionality rather than confirmed malware, warranting a confirmed_risk verdict.

Key Reasons

• 369 suspicious IoC domains with unusual TLDs (.tk, .dm, .km, .py)
• Random subdomain pattern (d., h., c., s., q., y.) indicates adware infrastructure
• Generic Gmail developer address with no company attribution
• Chrome live wallpaper functionality is technically unusual and suggests overlay/hijack

False Positive Considerations

• code-smell findings are expected noise
• no malware signatures present

Reviewed 2026-04-28; recommended action: escalate; model confidence 78%.