Hiyuki Shrine Maiden (WuWa) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

The extension Hiyuki Shrine Maiden (WuWa) Live Wallpaper bundles only a static New‑Tab page that displays animated wallpapers. The scan reports twelve medium‑severity IoC findings, all sourced from the generic placeholder path "extracted_from_files". The domains listed – ce.support, i.support, b.find.id, b.filter.id, oe.flat.call, jquery.org, c.postdispatch.call, f.remove.call, f.add.call, f.teardown.call, l.opts.fail, and l.opts.start.call – match the pattern of the XIOC extractor’s known garbage output, where fragments of minified JavaScript are mis‑interpreted as domain names. One entry (jquery.org) is a legitimate CDN host, while the others resemble class or function names rather than real network endpoints. No other evidence of network traffic, external script loading, or data exfiltration was found.

Crucially, the scan found zero malware signatures, zero explicit network rules, and no obfuscation markers. The manifest and source files contain no code‑smell alerts, and there are no dependencies that would introduce additional risk. The developer is listed only by an email address, and the extension has no user installs, but the absence of any functional code that contacts external servers means there is no observable malicious capability.

Given the nature of the reported IoCs, the most plausible explanation is the well‑documented XIOC false‑positive behavior, where minified variable names such as f.add.call are mistakenly labeled as domains. This aligns with the platform’s guidance that IoC volume alone should not drive a verdict, especially when the domains are non‑existent or resemble internal code identifiers.

A skeptic might argue that the presence of multiple unfamiliar domains indicates a hidden command‑and‑control channel, especially since the extension’s publisher is not a recognized entity. However, without any accompanying network call implementations, fetch statements, or dynamic URL constructions in the JavaScript, there is no mechanism for the extension to actually reach those domains. The scan’s lack of network findings and the exclusive reliance on the generic extractor output strongly support the conclusion that these entries are artefacts rather than active threats.

In summary, the extension’s code does not contain malicious payloads, and the reported IoCs are almost certainly false positives generated by the extractor. No further action is required beyond acknowledging the noise.

Key Reasons

• Only generic XIOC domain detections
• No malware signatures matched
• No network or fetch calls present
• No obfuscation or code‑smell findings

False Positive Considerations

• IoC extractor garbage
• no malware signatures
• no network findings
• no obfuscation

Reviewed 2026-06-02; recommended action: suppress false positive; model confidence 78%.