Jujutsu Kaisen Skull Inferno Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Jujutsu Kaisen Skull Inferno Live Wallpaper, version 1.0.7, comes from a publisher address at [email protected] and advertises looping anime video on the new tab page. The scan records no declared permissions and no host permissions. Nothing here grants access to cookies, history, form fields or page content.

The bulk of the evidence sits in 125 medium-severity domain indicators. Titles such as XIOC-DOMAIN-ɩ.gy, XIOC-DOMAIN-p.ee, XIOC-DOMAIN-q.za and XIOC-DOMAIN-no.ru share two traits: each glues a two or three character string to a country TLD, and each carries the file path extracted_from_files rather than a path inside the extension package. A domain extractor pulling candidates out of minified JavaScript produces exactly this pattern. Fragments of variable names, base64 blobs and property chains read as hostnames to a regex. Two of the entries, ɩ.gy and mݙ.cd, contain characters no registrar sells, which rules out live endpoints.

The other 19 findings carry low severity and the code-smell label. No malware signature matched. No obfuscation detector fired. No network finding recorded a runtime request. Those three absences outweigh the indicator pile, because a wallpaper extension that moved data off the machine would need code to open a connection, and this scan turned up none.

A skeptic would argue the noisy indicators might hide a real endpoint. That reads the evidence backwards. Every suspect string traces to extracted_from_files with no associated request, and with no host permissions declared, even a genuine domain in that list would be unreachable from the extension's scripts. A second objection: version 1.0.7 from an anonymous Gmail publisher with zero users deserves suspicion on reputation grounds alone. Fair, and we treat that as neutral. A blank reputation record says nothing either way, and it does not convert garbage indicators into a threat.

What would move this verdict: a runtime capture of the new tab page contacting an external host, or a manifest declaring host access to a domain the wallpaper has no use for. Neither shows up in this scan. One gap remains worth flagging. A wallpaper that overrides the new tab page normally declares chrome_url_overrides, and the recorded permission list holds nothing at all, so we cannot confirm how the override gets installed.

Key Reasons

• All 125 domain indicators carry the file path extracted_from_files with no matching runtime request, the signature of regex extraction on minified player code
• Zero malware signatures, zero obfuscation matches and zero network findings across the scan
• Indicator strings include non-registrable characters (ɩ.gy, mݙ.cd) and two-character plus ccTLD fragments identical to known extractor noise
• No declared permissions and no host permissions, so listed endpoints would be unreachable even if genuine
• Publisher is a Gmail address with zero users, which supplies no reputation signal in either direction

False Positive Considerations

• XIOC domain regex firing on minified JavaScript in the bundled video player
• Two-character plus ccTLD fragments misread as hostnames
• Low-severity code-smell rules matching ordinary bundled code
• Empty permission list leaving the new tab override mechanism unconfirmed

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 78%.