Wanderlustar

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Security Review: Wanderlustar Extension

This extension presents a new tab page experience with image discovery and search functionality. The security findings require careful interpretation to distinguish actual threats from known false-positive patterns.

YARA Findings Analysis

Nine high-severity findings appear in the malware-signature category, but all are postinstall_* rules: postinstall_crypto_operations, postinstall_file_download, postinstall_obfuscation, postinstall_file_manipulation, postinstall_network_communication, and NoUseWeakRandom. These rules are documented false positives that match basic Node.js patterns (fetch, crypto, file operations) present in virtually any non-trivial JavaScript extension. The file_path: "unknown_file" for all findings further indicates these are generic pattern matches rather than specific code analysis. The NoUseWeakRandom rule is a code-quality finding, not a malware signature.

Network Activity

Three network findings were detected: www/1.js:8 (xmlhttprequest), background.js:4 (fetch), and www/3.js:13 (xmlhttprequest). These are generic HTTP request detections without any suspicious domain indicators. No custom search domains (search., query., hp.*), no data exfiltration endpoints, and no third-party tracking domains were identified. For a new tab extension, basic network calls for loading images and search functionality are expected behavior.

Publisher Context

The developer is listed as [email protected] without a company name or verified publisher status. While anonymous attribution is less ideal, it alone does not constitute malicious behavior. The extension has 50,000 users, suggesting widespread adoption without reported security incidents.

Counterargument

A skeptic might argue that nine high-severity findings warrant concern regardless of their nature. However, the CVEQ platform documentation explicitly classifies postinstall_* rules as noise that "should NEVER drive a verdict." These findings have been reclassified as code-smell in the findings summary (showing code-smell: 10), confirming they are not actual malware signatures. Severity labels on false-positive rules do not indicate real risk. Without actual malware signatures, suspicious domains, obfuscation in runtime files, or credential theft indicators, the extension shows no evidence of malicious intent.

Conclusion

The findings are driven by known false-positive patterns. No actual malware, data exfiltration, or browser hijacking behavior was detected.

Key Reasons

• All malware-signature findings are postinstall_* rules, documented false positives matching generic Node.js patterns
• Network findings show only generic HTTP requests without suspicious domains
• No actual malware signatures, obfuscation, or credential theft indicators detected
• Findings summary classifies findings as code-smell rather than malware
• Extension has 50,000 users with no reported security incidents

False Positive Considerations

• postinstall_* YARA rules matching basic Node.js patterns
• Generic network call detections without suspicious domains
• Code-smell findings mislabeled as high-severity malware signatures

Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 75%.