Jinhsi And Dragon Wuthering Waves Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Jinhsi And Dragon Wuthering Waves Live Wallpaper (version 2.2, roughly 1,000 Chrome users, developer contact [email protected]) replaces the new tab page with artwork of the Wuthering Waves character Jinhsi. The manifest declares no permissions and no host permissions, so it has no declared route into page content, cookies, or tab data. The publisher identity is a freemail address with no company attached, which is the one detail worth noting.

The 233 indicator entries carry no weight here. The extracted list is 0z.co, 2y.la, 5o4.is, b2.pl, cak.hu and similar two and three character strings, plus several containing non-Latin characters: 0ɝj.aw, 2ӄ.gm, 6ߌ.ae. None of those are registrable hostnames. They are token fragments the extractor pulled out of minified JavaScript and re-typed as domains. A wall of impossible domains is a parser artifact, not infrastructure.

Six findings flag fetch() calls: NET-FETCH-js/background.js-63, -82 and -96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Each records a call site, not a destination. js/weather.js:49 sits in a file named for weather, which fits the weather strip new tab pages commonly ship with, and sidePanel.js:362 and popup.js:39 are UI surfaces that would pull the same data. What this evidence cannot do is name the host those calls reach, because endpoint extraction returned fragments rather than URLs. That gap is the honest limit of this review.

A skeptic would point at the combination: fan-art wallpaper, a publisher whose only identity is an email address, no source repository, six outbound requests, and 233 network indicators. That is a fair list. It still does not add up to harm, because every one of those 233 indicators is unregisterable text, and because no malware signature, no obfuscation finding, no hardcoded secret and no dependency finding matched across the 283 total items. The 44 code-smell hits are low severity pattern matches that fire on ordinary compressed JavaScript. What would flip this: a fetch argument in js/background.js containing a real third-party hostname, or a chrome_url_overrides value pointing outside the extension's own files.

Until someone reads those fetch arguments, the read that fits the evidence is a small fan project whose only outbound traffic is its static assets and a weather call, with scanner noise doing the rest of the work.

Key Reasons

• All 233 network indicators are unregisterable two-to-three character strings, several containing non-Latin characters (2ӄ.gm, 6ߌ.ae), produced by the IoC extractor from minified JavaScript
• Zero malware-signature, obfuscation, secret, dependency or tool-poisoning findings across 283 total items
• The six NET-FETCH findings (js/background.js:63/82/96, js/popup.js:39, js/sidePanel.js:362, js/weather.js:49) record fetch call sites in UI and weather code, not hostile destinations
• Manifest declares no permissions and no host permissions, removing access to page content, cookies and tabs
• The 44 code-smell findings are low severity pattern matches with no co-located malware signature

False Positive Considerations

• IoC extractor emitted unregisterable 2-3 character strings, some with non-Latin characters, from minified JavaScript
• Network findings capture fetch() call sites only; no real hostnames were resolved from the bundle
• 44 low-severity code-smell matches fire on ordinary compressed JavaScript
• High finding volume (283) comes from bundled asset and library code rather than extension logic

Reviewed 2026-10-17; model confidence 80%.