Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Sage And Omen Valorant Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 1 weeks ago
- Version
- v3.6
- Artifact
- SHA256 A38…836
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 1 | js/background.js | - |
| LOW | postinstall file download | 5 | js/popup.jsjs/sidePanel.jsjs/background.js +2 more | - |
| LOW | SQLInjection | 3 | js/todo.jsjs/script.jsjs/jquery-3.7.1.min.js | - |
| LOW | NoUseWeakRandom | 2 | js/createStickyNote.jsjs/jquery-3.7.1.min.js | - |
| LOW | LocalStorageShouldNotBeUsed | 3 | js/createStickyNote.jsjs/todo.jsjs/script.js | - |
| LOW | postinstall file manipulation | 14 | js/sidePanel.jsjs/chatgpt.jsjs/calculator.js +11 more | - |
| LOW | postinstall crypto operations | 3 | js/script.jsjs/jquery-3.7.1.min.js_metadata/verified_contents.json | - |
| LOW | postinstall network communication | 7 | js/background.jsnewtab.htmljs/script.js +4 more | - |
| LOW | postinstall obfuscation | 4 | newtab.htmljs/sidePanel.jsjs/background.js +1 more | - |
| LOW | postinstall system command | 2 | js/jquery-3.7.1.min.jsimg/bg.mp4 | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(44 hits)Requested Permissions
4 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension 'Sage And Omen Valorant Live Wallpaper' (version 3.5) presents no security findings in the provided evidence bundle. The findings_by_category object is empty, indicating no detected IoCs, code-smell triggers, obfuscation, or malware signatures. The developer is listed as [email protected], an email address rather than a verified organization. The extension's description aligns with its stated purpose: delivering live wallpapers for Valorant agents. No suspicious domains, network requests, or behavioral anomalies were identified.
The absence of findings is notable but does not confirm safety. A skeptic might argue that the anonymous publisher (email-only attribution) and moderate user count (569) could mask malicious intent. However, the lack of any technical indicators—such as credential access, data exfiltration, or hijacking mechanisms—weakens this concern. The extension's functionality (displaying game-themed wallpapers) does not inherently require high-risk permissions.
The strongest counterargument is that zero findings could result from incomplete analysis. However, the version is specified (3.5), and the data appears current. Without evidence of malicious behavior, the extension aligns with benign-but-powerful categories. The verdict prioritizes the absence of concrete threats over publisher anonymity, as the latter alone does not constitute risk.
Key Reasons
- Zero security findings detected
- Functionality matches stated purpose (live wallpapers)
- No suspicious domains or network activity
- Anonymous publisher lacks verification
False Positive Considerations
- Empty findings_by_category
- Anonymous publisher email
- No code-smell or IoC triggers
Reviewed 2026-04-25; recommended action: monitor; model confidence 75%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]