Shoto Todoroki My Hero Academia Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Six network findings sit in four files: NET-FETCH-js/background.js-63, -82 and -96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Each marks a fetch call in ordinary extension code. The file names describe the work: js/background.js refreshes the wallpaper, js/weather.js fills the weather strip, js/popup.js and js/sidePanel.js draw the extension's own interface. A new tab wallpaper with a weather widget needs network calls, and six of them across four files matches that feature set.

The other 1777 entries in the indicator bucket are the reason this case looks bigger than it is. Sample the endpoint list and the shape is obvious: 1aì.kh, 4ݳnɧ.dhl, 9ϗ1h.gw, 1u.sb, 58n.ma, 4ca.dz. The suffix .dhl is not a top-level domain, and several entries mix Greek or Cyrillic glyphs into a Latin prefix in a form no registrar would issue. The remaining entries pair a short random prefix with a real country code: .kh, .sd, .sb, .jo, .lc, .dz, .ma, .fr, .gf, .tr, .gs, .ws, .bm, .mg, .sc, .mp, .pt. That is what a country-code suffix table looks like after a regex sweep across minified JavaScript, where every token.token pair gets read as a hostname.

Nothing else in the package supports a malicious reading. No malware signature matched, no obfuscation was flagged, no bundled dependency raised a hit, no secret was exposed, and no tool-poisoning pattern fired. The only other category present is 45 code-smell notes at low severity, the sort of thing that trips on utility code and variable naming in any bundled library.

The manifest data shows no permissions and no host_permissions. That constrains the extension in a useful way: a Manifest V3 extension page without host permissions cannot fetch arbitrary hosts, which puts a ceiling on what any of the six fetch calls could accomplish.

On identity, "Shoto Todoroki My Hero Academia Live Wallpaper" describes its own content, and the publisher address [email protected] belongs to a live-wallpaper studio. The name points at an anime character; no security product is being imitated. The fair complaint is that the My Hero Academia character is used without a license from the rights holders, which is a store policy question rather than a sign that the extension takes anything from you.

A skeptic would point at 1777 indicators and 695 users and argue nobody would notice a bad build at that scale. Volume is the wrong instrument here. Every entry examined has the same broken shape, and a real exfiltration path would leave at least one host permission, one named endpoint, or one obfuscated loader. What would change this verdict: a manifest granting , or a runtime capture showing traffic to a host outside the wallpaper and weather features.

Key Reasons

• All 1777 indicators follow a misparse pattern: invalid suffixes like .dhl plus short prefixes glued to real country codes (.kh, .ma, .dz), the signature of a regex sweep over minified code
• Zero malware signatures, zero obfuscation, zero dependency and zero tool-poisoning findings across the package
• The six NET-FETCH findings sit in feature files (js/weather.js, js/background.js) that match a weather widget and wallpaper refresh
• No permissions and no host_permissions declared, which limits what the extension can reach
• Name and developer ([email protected], a live-wallpaper studio) show no impersonation of a security or utility brand

False Positive Considerations

• XIOC extractor treating every word.word pair in minified JS as a hostname, inflating the count to 1777
• An embedded country-code suffix table producing entries like 58n.ma and 4ca.dz that resemble domains
• 45 low-severity code-smell rules that fire on ordinary bundled JavaScript
• Ordinary fetch calls in feature files counted as medium-severity network findings

Reviewed 2026-10-17; recommended action: suppress false positive; model confidence 82%.