Hatsune Miku China Dress Live Wallpaper

AI Security Review

Evidence context: threat category pup; evidence quality moderate.

Extension Overview

The extension "Hatsune Miku China Dress Live Wallpaper" by developer [email protected] presents multiple risk indicators warranting caution. The extension has 704 users and claims to provide live wallpaper functionality, a category frequently abused for adware distribution.

Suspicious Network Domains

The IoC findings reveal several concerning domains extracted from the extension code. The domains custom.click, trigger.click, and shortcut.click use the .click TLD, which is commonly associated with affiliate tracking and click monetization networks. Additionally, data.top and note.style.top use the .top TLD, which is frequently employed for data collection endpoints. These domains appear in the extracted IoC list alongside legitimate Chrome API references.

The network findings show fetch calls in js/popup.js:35 and js/script.js:17, confirming the extension makes external network requests. Without visibility into what data these requests transmit, the combination of fetch calls and suspicious TLD domains creates a data exfiltration risk profile.

False Positive Context

Several IoC findings are clearly false positives from the XIOC extractor: chrome.runtime.id is a Chrome API reference, not a domain. Property access chains like note.dataset.id and data.id are JavaScript object property chains misidentified as domains. These account for a significant portion of the 133 total IoC findings.

Anonymous Publisher

The developer is listed only as an email address ([email protected]) with no company name or verified identity. This anonymous publication combined with suspicious network destinations is a documented risk pattern for potentially unwanted programs.

Counterargument Assessment

A skeptic might argue that without malware signatures or obfuscation, this extension is benign. However, the absence of malware signatures does not preclude PUP behavior. The specific combination of anonymous publishing, click-tracking TLD domains, and live wallpaper category (a known adware vector) creates sufficient evidence for a risk classification. The extension's behavior pattern aligns with monetization through affiliate links or data collection rather than straightforward malware, but still represents user risk.

Key Reasons

• Suspicious .click TLD domains (custom.click, trigger.click, shortcut.click) indicate click-tracking/affiliate network
• Anonymous developer (email only, no company name)
• Suspicious .top TLD domains (data.top, note.style.top) suggest data collection endpoints
• Live wallpaper category is frequently abused for adware distribution
• Network fetch calls in popup.js and script.js with unverified destinations

False Positive Considerations

• chrome.runtime.id is a Chrome API reference, not a domain
• Property access chains (note.dataset.id, data.id) misidentified as domains
• Code-smell findings (19 total) are known noise sources
• High IoC count inflated by XIOC extractor false positives

Reviewed 2026-05-03; recommended action: monitor; model confidence 75%.