Mitsuri Kanroji - Demon Slayer Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

All six findings on this extension are the same kind of thing: outbound network calls. They land at NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82 and NET-FETCH-js/background.js-96 in the service worker, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Nothing else matched. Zero IoCs, zero malware signatures, zero obfuscation findings, zero dependency findings and zero secrets were recorded, and the endpoint list came back empty.

The extension's stated job explains those calls. It replaces the new tab page with a live video wallpaper of a Demon Slayer character. Live video cannot ship inside a package, so the background service worker has to pull it at runtime, which is what the fetches in js/background.js are doing. The fetch in js/weather.js at line 49 points to a weather lookup, a standard new tab widget. js/popup.js and js/sidePanel.js are the extension's own UI surfaces, and a fetch there typically loads a thumbnail or a settings feed.

What the extension does not do is as telling as what it does. No manifest-level permission is declared, and no host permission either. That rules out the access patterns that make a wallpaper extension dangerous: reading browsing history, touching cookies, injecting into banking or social login pages, or rewriting search. There is no custom search provider, no URL template construction and no new tab redirect to a monetised domain. There is also no impersonation angle, since the name references an anime character rather than a popular extension.

A skeptic would push back here, and reasonably so. Anime and game-character wallpaper extensions are a documented nuisance category, and the publisher trades as [email protected] with no verified developer identity, 1,000 users and version 2.3. A wallpaper extension that later changes its endpoints could start redirecting the new tab page, and the scan cannot see where the six fetches point because the endpoint list is empty. That is the real gap.

It is still not evidence of harm in this build. Every flag is a call site, not a destination. For the verdict to flip, we would need the resolved domains behind js/background.js:63 and the other call sites, or a manifest-analysis finding showing a search override or a history permission. Neither is present.

Key Reasons

• All six findings are outbound fetch call sites (js/background.js:63, :82, :96, js/popup.js:39, js/sidePanel.js:362, js/weather.js:49) with no destination or payload detail attached.
• Zero IoCs, malware signatures, obfuscation, code-smell, dependency or secret findings across the scanned files.
• No permissions and no host permissions declared, so there is no history, cookie, credential or page-injection surface.
• Runtime network traffic is expected for an HD live video wallpaper that streams content into the new tab page.
• No impersonation signal: the name references an anime character rather than mimicking an existing popular extension.

False Positive Considerations

• Network findings are generic fetch call sites with no endpoint or payload data
• No IoC, malware-signature, obfuscation, dependency or secret matches recorded
• Live video wallpaper requires runtime fetch calls by design
• Empty permissions and host permissions list leaves no sensitive capability to flag

Reviewed 2026-10-13; recommended action: no action; model confidence 72%.