Cute Hello Kitty Sitting Room Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension presents a classic false-positive profile driven by the CVEQ XIOC extractor's known noise patterns. The 313 IoC findings consist entirely of property access chains misidentified as domains: e.call, l.call, b.filter.id, b.find.id, he.call, de.call, and se.call are JavaScript property chains (object.property.method), not network destinations. The finding fonts.gstatic.com is a legitimate Google CDN domain used for web fonts, not suspicious infrastructure. The i.support and ce.support domains follow the same pattern of short strings that could be either real domains or minified code fragments.

Critically, there are zero malware-signature findings, zero obfuscation findings, and zero network findings. The 17 code-smell findings are all low severity and represent the expected noise from YARA rules like postinstall_* and credential_* that match any non-trivial JavaScript. These code-smell findings are explicitly documented as noise sources in the CVEQ platform.

The extension's metadata supports a benign verdict: the name "Cute Hello Kitty Sitting Room Live Wallpaper" is descriptive and matches its stated purpose of customizing the new tab page. There is no typosquatting or impersonation of known brands. The developer [email protected] is a personal Gmail address rather than a verified organization, but this alone does not indicate malice—many legitimate indie developers publish with personal accounts. The user count of 127 is low but consistent with a niche cosmetic extension.

The strongest counterargument would be the sheer volume of 313 IoC findings, which could suggest hidden malicious network activity. However, finding count is not evidence of threat—finding nature is. All 313 IoCs are medium severity with no accompanying malware signatures, obfuscation, or actual network findings. If this extension were exfiltrating data or communicating with C2 infrastructure, we would see malware-family YARA matches, obfuscation to hide the payload, and network findings showing actual traffic patterns. The complete absence of these signals, combined with the property-chain pattern in the IoCs, confirms this is XIOC extractor garbage rather than real threat indicators.

No action is required. This extension is a cosmetic new tab page customization with no evidence of malicious behavior.

Key Reasons

• All 313 IoC findings are property chain false positives (e.call, b.filter.id, etc.) or legitimate CDN domains (fonts.gstatic.com)
• Zero malware signatures detected despite 330 total findings
• Zero obfuscation findings—malicious extensions typically obfuscate payloads
• Zero network findings—no actual traffic patterns detected
• Extension name and description are descriptive with no typosquatting indicators

False Positive Considerations

• XIOC property chain misidentification (e.call, b.filter.id, l.call)
• Legitimate CDN domains flagged as IoCs (fonts.gstatic.com)
• Code-smell YARA rules firing on standard JavaScript patterns
• IoC volume inflation from minified/bundled code extraction

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 85%.