Satoru Gojo Black Grey Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Security Analysis: Satoru Gojo Black Grey Live Wallpaper

This extension is a legitimate wallpaper tool for Chrome's new tab page. The 323 total findings are driven entirely by known false positive patterns in the CVEQ detection pipeline.

IoC Findings Are Garbage Data

All 299 IoC findings match the documented XIOC extractor false positive pattern for property access chains misread as domains. The evidence shows r.call, t.map, o.empty.fire, de.call, he.call, e.id, e.next, i.call, i.select, i.support, and pe.call extracted from extracted_from_files. These are JavaScript property access patterns (e.g., r.call()), not actual network domains. The XIOC extractor documentation explicitly lists this pattern as a known noise source.

Network Activity Is Normal

The only substantive finding is NET-FETCH-js/popup.js-35, which detects a fetch call in the popup script. A wallpaper extension must load images, so this network activity is expected behavior. No suspicious domains, no data exfiltration patterns, and no third-party tracking endpoints appear in the evidence.

No Malware Indicators

The findings summary shows zero malware signatures, zero obfuscation findings, and zero credential theft patterns. The 22 code-smell findings are low-severity noise that fire on any non-trivial JavaScript. There is no evidence of typosquatting, browser hijacking, or credential theft.

Counterargument: High Finding Count

A skeptic might argue that 323 findings with a 299 IoC count indicates significant risk. This reasoning is flawed. The CVEQ scoring system has documented biases where IoC volume disproportionately inflates scores. The nature of these findings—not their count—determines risk. All 299 IoCs are the same false positive pattern (property access chains), not 299 distinct suspicious domains. The extension has a clear description matching its function, a developer email ([email protected]), and 1,000 users suggesting legitimate distribution. No actual malicious behavior is present.

Conclusion

This extension poses no security threat. The findings result from known CVEQ pipeline noise, not malicious code.

Key Reasons

• All 299 IoC findings are property access chain false positives (r.call, e.id, i.support, etc.)
• Zero malware signatures and zero obfuscation findings
• Network finding is a normal fetch call in popup.js for loading wallpaper images
• Extension has clear description matching wallpaper functionality
• No suspicious actual domains in the evidence

False Positive Considerations

• XIOC property access chain extraction (r.call, e.id, i.select patterns)
• Code-smell rules firing on standard JavaScript
• IoC count inflation from garbage patterns

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 88%.