Michael Jackson Cosmic Stardust Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

What the manifest allows

The extension asks for nothing. Both permissions and host_permissions come back empty, which rules out cookies, scripting, tabs, webRequest and cross-origin fetch to a remote image host. A new-tab wallpaper extension shipping zero permissions can render bundled assets and do little else. That single fact constrains most of the threats worth worrying about here.

What the domain findings actually are

Every entry in the IoC list follows one shape: two or three characters followed by a country-code suffix. XIOC-DOMAIN-b.by, XIOC-DOMAIN-m.do, XIOC-DOMAIN-sl.cc, XIOC-DOMAIN-j1.np, XIOC-DOMAIN-q.man. A few carry non-ASCII characters where a subdomain label would sit: XIOC-DOMAIN-ݘ.lv, XIOC-DOMAIN-ψ.my, XIOC-DOMAIN-þca.sj, XIOC-DOMAIN-ŕ.et. Those do not parse as registrable hostnames, and registrars do not sell single-character labels in that position. These are tokens lifted out of minified JavaScript, where x.by, m.do and p.is are property accesses and the extractor read the dot as a domain separator. The network_endpoints list repeats the same tokens (1d.re, 1v.cd, 3u.nz, 5hb.us, a9.wf, custom.show), which is what one noisy pass over the same bundle produces.

The lone real URL, XIOC-URL-https://x.com, points at X. A social link in the store listing or options page would generate exactly that.

Code-smell and the empty categories

Nineteen results sit in the code-smell bucket at low severity. The categories that would matter hold zero entries: no malware signature, no malware family match, no obfuscation, no network finding, no dependency, no secret, no tool-poisoning. Code-smell rules fire on ordinary JavaScript constructs such as eval guards, weak random calls and environment-variable reads. For a bundled wallpaper script, that volume of matches describes the language, not the extension.

The counterargument

A skeptic could point at the publisher: [email protected] given as the developer name, no company behind it, zero users, a version string at 1.0.8, and a description leaning on a celebrity's name. Anonymous wallpaper extensions do exist to farm installs, and unlicensed use of a performer's likeness is a genuine trademark problem. That argument concerns the extension's business model and its legality, and it does not move the security verdict. Exfiltrating anything requires host permissions to reach an outside server, and the manifest grants none. Calling code malicious takes evidence of harmful behavior, and the scanned code holds none.

Verdict basis

The finding volume is extractor noise from minified JavaScript, the capability surface is empty, and the only concrete indicator in the set is a link to x.com.

Key Reasons

• Manifest declares no permissions and no host_permissions, so the code cannot reach any of the domains it is flagged for.
• Domain IoCs follow the two-or-three-character plus ccTLD pattern of minified JS property chains (XIOC-DOMAIN-b.by, XIOC-DOMAIN-m.do, XIOC-DOMAIN-sl.cc).
• Zero malware signature, zero malware, zero obfuscation, zero network, zero dependency and zero secret findings.
• The only concrete URL in the evidence is XIOC-URL-https://x.com, a social link.
• Remaining results are low-severity code-smell rules that fire on ordinary JavaScript constructs.

False Positive Considerations

• XIOC extractor reading minified JavaScript property chains as domains
• Non-ASCII tokens flagged as domains (ݘ.lv, ψ.my, þca.sj, ŕ.et)
• Low-severity code-smell rules matching generic JavaScript patterns
• network_endpoints list duplicating the same garbled tokens from one extraction pass

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 82%.