Labubu Rainbow Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension exhibits a classic false-positive pattern driven by the XIOC extractor's known garbage output. All 260 IoC findings are property access chains misidentified as domains: finish.call, this.name, l.style, this.now, e.top, e.elem.style, t.events, this.map, and similar patterns like this.options.step.call and l.opts.start.call. These are JavaScript property access patterns, not actual network destinations, and represent a well-documented noise source from the CVEQ IoC extraction pipeline.

Critically, the extension has zero malware signatures and zero obfuscation findings. The 35 code-smell findings are classified as low-severity noise per the triage guidelines—these rules fire on almost any non-trivial JavaScript and should not drive verdicts. The 3 network findings lack specific suspicious domains; without concrete evidence of malicious destinations, they cannot support a malicious verdict.

The extension's purpose aligns with its description: an animated live wallpaper featuring Labubu character art. There is no evidence of browser hijacking (no custom search engines, no new tab replacement), no credential theft indicators (no login domain targeting), no proxyware functionality, and no typosquatting (Labubu is a legitimate character from Pop Mart toys, not an impersonation of a known extension).

The strongest counterargument is the anonymous developer attribution ([email protected] instead of a verified publisher name) combined with zero user count, which could indicate a newly deployed malicious extension. However, anonymous publishers are common for legitimate indie extensions, and the absence of actual malware signatures, obfuscation, or suspicious network destinations outweighs this concern. The evidence would need concrete malicious indicators—such as malware signatures co-located with obfuscation, or specific suspicious domains in network findings—to warrant a confirmed_malicious verdict. Without those, the high finding count is entirely attributable to known false-positive patterns.

Key Reasons

• All 260 IoC findings are XIOC extractor false positives from property access chains
• Zero malware signatures detected
• Zero obfuscation findings
• Code-smell findings are known noise per triage guidelines

False Positive Considerations

• XIOC property access chain extraction (finish.call, this.name, l.style, etc.)
• Code-smell rules firing on standard JavaScript patterns

Reviewed 2026-04-29; recommended action: suppress false positive; model confidence 85%.