Ghibli Coffee Shop Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension presents a classic false-positive pattern driven by the XIOC extractor misinterpreting JavaScript property access as domain names. The 354 IoC findings include domains like ae.call, t.call, n.call, s.call, db.name, and ce.map — these match the documented false-positive pattern where property access chains (e.g., obj.call, obj.name) are parsed as domain strings. None of these domains represent actual network destinations; they are artifacts of static analysis parsing errors.

The extension has zero malware signatures and zero obfuscation findings, which are the strongest indicators of benign behavior. The 22 code-smell findings are classified as low severity and match known noise patterns (e.g., postinstall_* rules that fire on basic Node.js patterns). The single network finding in js/script.js:17 is a standard fetch call with no suspicious destination specified.

One IoC (ԣ.tc) contains a Cyrillic character (ԣ), which could indicate encoding issues or a false positive from string parsing rather than intentional obfuscation. The domain jquery.org is a legitimate CDN, and gameograf.com is a known game development company — neither is suspicious. Short URL services like d.us are common in legitimate extensions for tracking or analytics.

The developer is listed as an email address ([email protected]), which provides limited attribution but is not inherently malicious. The extension description ("Step into the magical world of Ghibli with the Ghibli Coffee Shop Live Wallpaper") describes a legitimate wallpaper feature with no indication of deceptive naming or impersonation.

Counterargument: A skeptic might argue that the anonymous developer email and 1,000 users combined with 354 IoC findings warrant concern. However, the verdict rests on finding nature not count. The IoC patterns match documented false-positive behavior (property access chains misread as domains), there are no malware signatures, no obfuscation, and no evidence of credential theft, browser hijacking, or data exfiltration. The extension's stated purpose (live wallpaper) aligns with its minimal network activity. Without malware signatures or suspicious domains in actual network calls, the finding volume is noise from the XIOC extractor, not evidence of malicious behavior.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation findings
• IoC domains match XIOC false-positive pattern (property access chains like .call, .name, .map)
• Minimal network activity (2 findings, one standard fetch call)
• Extension purpose (live wallpaper) aligns with observed behavior

False Positive Considerations

• XIOC extractor misreading JavaScript property access chains as domains
• Code-smell findings (22 low-severity) from generic patterns
• Legitimate CDN domains (jquery.org) flagged as IoCs
• Bundled dependencies inflating finding counts

Reviewed 2026-04-29; recommended action: suppress false positive; model confidence 82%.