Obito X Ten Tails Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Obito X Ten Tails Live Wallpaper replaces the Chrome new tab page with a looping HD video of the anime character. Version 5.3 has roughly 1,000 users and is published under the contact address [email protected]. The scanned manifest declares no permissions and no host permissions, and no network endpoints were captured, so this review rests entirely on six medium-severity network findings: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49.

Each one marks a fetch call site in a different script, and the placement matches the product. Three sit in js/background.js, which is where a wallpaper extension loads and caches its video files. js/popup.js:39 runs when the user opens the toolbar popup, a common place to check for a newer wallpaper pack. js/sidePanel.js:362 sits in the side panel code, probably a settings or search surface. js/weather.js:49 belongs to a weather module, and any weather widget on a new tab has to call an endpoint to get a forecast. None of the findings record where those six calls go, so the destinations are unverified from this data.

The rest of the scan is empty. Zero IoC domains, zero malware signatures, zero obfuscation findings, zero code-smell results, zero dependency and secret findings, and no manifest-analysis issues. For an extension whose only job is to play a video, that combination is ordinary. There is no injected content script reading login pages, no cookie access, no eval, and no packed blob hiding a second payload in js/background.js.

A skeptic would point at the shape of the evidence: six outbound request sites, no recorded destinations, and a publisher identified by an email address rather than a company. That is the profile of an extension that phones home, and wallpaper extensions that collect browsing data have shipped before. The counterweight is that the scan found none of the machinery that collection requires. There is no IoC list, no signature match, and no obfuscation in any of the files that make the requests. Six bare fetch call sites are what any extension loading remote media produces, and treating the count itself as the problem would flag every weather widget on the store.

The decisive test is cheap: resolve the request URLs at those six call sites. If they point to a gameograf.com asset host or a public weather API, the case closes. If they point to an unrelated collector domain, this verdict should be revisited immediately.

Key Reasons

• All six findings are bare fetch call sites in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, with no destination URLs recorded
• Request placement matches a video new-tab extension: media loading in background.js and a forecast lookup in weather.js
• No malware signatures, obfuscation, IoCs, code-smell, dependency, secret or manifest-analysis findings in the scan
• No cookie, credential or content-script injection code flagged in any file
• Publisher domain gameograf.com is consistent with a wallpaper or game-art studio, though attribution is only an email address

False Positive Considerations

• Network findings record the existence of a fetch call, not a malicious endpoint
• New tab wallpaper extensions must fetch remote video assets to function
• Weather module in js/weather.js requires an external forecast API by design
• Absence of any IoC, signature or obfuscation finding means volume is not driven by suspicious content

Reviewed 2026-10-19; recommended action: suppress false positive; model confidence 75%.