Red Eyed Sword Anime Girl Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Extension Profile

"Red Eyed Sword Anime Girl Live Wallpaper" is a Chrome extension with 184 users, published by [email protected]. The extension claims to provide animated wallpapers featuring anime characters. The analysis reveals 820 total findings, but the nature of these findings is critical to understanding the actual risk.

Finding Analysis

The findings breakdown shows 803 IoC findings, 17 code-smell findings, and critically, zero malware signatures, zero obfuscation findings, and zero network findings. All 803 IoC findings are XIOC-DOMAIN detections for domains like d.mw, i0.wf, ƨ8.ly, 1.gr, b.ps, e.dm, 2.bz, e.gs, n.mz, v.yt, 8k.sj, and w-.mm, all extracted from generic "extracted_from_files" paths rather than specific source files.

These domain patterns are characteristic of XIOC extractor false positives. The guidelines explicitly state that "property access chains misread as domains: b.call, h.next, g.id" are common garbage outputs. The detected domains (d.mw, i0.wf, ƨ8.ly) follow identical patterns—short alphanumeric strings with unusual TLDs that match property access syntax rather than actual malicious infrastructure. Additionally, the file_path "extracted_from_files" is non-specific, suggesting these IoCs came from bundled dependencies or minified code where the extractor cannot distinguish between actual domains and code patterns.

The 17 code-smell findings are classified as low severity and fall into documented noise categories. According to the CVEQ false positive documentation, code-smell rules like credential detection, postinstall patterns, and code-quality checks "fire on almost any non-trivial JavaScript" and "should NEVER drive a verdict."

Malware Evidence Assessment

The absence of malware signatures is the strongest indicator of benign behavior. A genuinely malicious extension would trigger at least some malware-family YARA rules, especially combined with obfuscation. This extension has zero malware-signature findings and zero obfuscation findings. The XIOC-DOMAIN findings alone, without corroborating malware signatures or obfuscation, do not constitute evidence of malicious intent.

Counterargument

A skeptic might argue that 803 IoC findings represents significant suspicious activity, especially with an anonymous Gmail developer and unusual domain patterns. However, this argument fails because it treats finding COUNT as evidence when the guidelines explicitly state "IoC COUNT alone is meaningless. Only specific, non-generic suspicious domains matter." None of these domains are known C2 infrastructure, and the pattern matches documented XIOC false positive behavior. The absence of malware signatures, obfuscation, and network findings outweighs the volume of IoC noise. Without evidence of actual malicious code behavior, the high finding count is better explained by false positive patterns than by hidden malware.

Key Reasons

• Zero malware signatures despite 820 total findings
• Zero obfuscation findings indicates no hidden code
• XIOC-DOMAIN patterns match documented false positive behavior (property chains misread as domains)
• All IoCs from generic extracted_from_files path rather than specific source files
• Code-smell findings are documented noise that should not drive verdicts

False Positive Considerations

• XIOC-DOMAIN false positives from property access chain misinterpretation
• Code-smell findings classified as documented noise
• Generic file_path extraction without source file specificity
• No malware signatures despite high finding volume

Reviewed 2026-04-30; recommended action: suppress false positive; model confidence 72%.