Hiyuki The First Strike (Wuthering Waves) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension Hiyuki The First Strike (Wuthering Waves) Live Wallpaper contains no executable code that reaches out to external servers; the only findings are a series of domain matches reported under the title XIOC‑DOMAIN‑** and all are located in the generic source placeholder extracted_from_files. These include well‑known infrastructure such as jquery.org and short‑link services like g.gg, as well as a handful of obscure domains (ovkas.com, wf.aw, ke.th, o.empty.fire, so.hn, q.de, 1.pn, p3p.br, v.events, ce.support). The XIOC extractor is known to produce many false‑positive entries from minified JavaScript and bundled third‑party libraries, and none of the listed domains are uniquely tied to known malicious‑type services.

No malware signatures were matched, and the findings_summary reports zero entries for malware‑signature, malware, obfuscation, code‑smell, or network categories. This absence strongly suggests that the extension’s packaged files contain no active payload, persistence mechanisms, or network‑related code. The extension’s purpose—displaying a live wallpaper on the New Tab page—is consistent with its description, and there is no evidence of hijacking, credential theft, or proxy behavior.

The developer is listed only as an email address ([email protected]) without a verified organization or brand association. While lack of a recognized publisher can be a risk signal, it does not by itself constitute malicious intent, especially when the codebase shows no suspicious constructs. The extension’s user count is zero, indicating it has not been widely installed; this further reduces the likelihood of an active threat campaign.

A skeptical reviewer might point to the presence of obscure domains such as ovkas.com or o.empty.fire as indicators of tracking or ad‑serving activity, arguing that even without explicit network calls, the extension could later be updated to include malicious endpoints. However, the current static analysis reveals no code that initiates requests, no obfuscated strings, and no configuration files referencing these domains. Without executable paths that use the listed domains, they remain inert artefacts of the IoC extraction process rather than active threats. Continuous monitoring of future updates would be prudent, but the present evidence does not support a malicious classification.

Key Reasons

• Only generic IoC matches with no executable network code
• Zero malware‑signature or obfuscation findings
• No network or code‑smell detections indicating active behavior
• Domains stem from known false‑positive patterns of the XIOC extractor

False Positive Considerations

• IoC extractor garbage producing generic domain matches
• High IoC count from bundled third‑party libraries
• Absence of network or malicious code findings

Reviewed 2026-06-02; recommended action: no action; model confidence 78%.