White Black Dragons Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

White Black Dragons Live Wallpaper is a new-tab extension listed under the contact address [email protected]. The manifest declares no permissions and no host_permissions, so it does not ask for tabs, cookies, browsing history, downloads or script injection. The network findings are fetch calls in js/background.js at lines 63, 82 and 96, js/popup.js line 39, js/sidePanel.js line 362 and js/weather.js line 49. That file spread matches the stated product: a wallpaper loader, a popup, a side panel and a weather widget. The endpoint inventory includes api.gameograf.com and gameograf.com, which sit on the publisher's own domain, plus chat.openai.com for a chat panel and youtube.com and www.blogger.com for links.

Most IoC matches do not describe real destinations. sidepanel.open and sidepaneltoggle.is are JavaScript property or method names, not hostnames. The presence of sidepanel.open is a clean tell: that string is a call target, not a URL a browser could resolve. dغ.sv contains a non-ASCII letter and cannot be a normal registrable domain. jquery.org is not the jQuery CDN, which is jquery.com. The remaining short strings such as 6j.tv, bg.mp, ke.td, nq.bo, ps.uy and sl9.ro have the shape of minified variable or property fragments that an extractor promoted to domains. None is tied to a named fetch finding. The findings with file paths, such as NET-FETCH-js/weather.js-49, point at expected feature files, not at a hidden redirect or search hijack.

The code-smell findings are all low severity. No malware signature, no malware family rule, no obfuscation, no secret and no dependency finding matched. No manifest problem was flagged. A wallpaper extension with a side panel and weather widget will contain ordinary JavaScript for network requests, DOM updates and weather parsing, which is exactly the material these rules flag. The js/sidePanel.js fetch at line 362 lives in the file that draws the side panel, not in a content script that injects into login pages. The absence of any high or critical finding, together with the empty permissions array, makes credential theft, browser hijacking and proxyware implausible for this build.

The strongest counterargument is that a new-tab extension with short, unfamiliar domains in its endpoint list could be contacting a command-and-control host. If 6j.tv or sl9.ro were actually used by js/background.js, that would matter. The evidence does not show that connection. The fetch findings are attached to named files (js/background.js, js/popup.js, js/sidePanel.js, js/weather.js), while the malformed entries sit in a flat list alongside obvious non-domains such as sidepanel.open. A runtime capture of traffic while opening a new tab and the side panel would settle it. Until then, the balance of evidence is scanner noise around a normal feature set.

Key Reasons

• No malware, obfuscation, secret or dependency findings; all code-smell hits are low severity
• Manifest declares no permissions and no host permissions
• Network findings are ordinary fetch calls in background.js, popup.js, sidePanel.js and weather.js
• Endpoints include the publisher's api.gameograf.com and gameograf.com plus chat.openai.com for a chat panel
• Many IoCs are malformed property names or invalid domains, such as sidepanel.open and dغ.sv

False Positive Considerations

• IoC extractor promoted JavaScript property names such as sidepanel.open and sidepaneltoggle.is to domains
• Invalid or non-registrable strings such as dغ.sv and jquery.org in the endpoint inventory
• Low-severity code-smell rules firing on ordinary fetch, DOM and weather-widget JavaScript
• Network fetch findings point to the extension's own api.gameograf.com and expected widget services

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 84%.