Zoey K-pop Demon Hunters Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

No malware signature matched in any file, and the scan found no obfuscation, no bundled secrets and no manifest problems. What it did return is six network calls and a large set of string matches that do not survive a second look.

The network calls are ordinary. NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82 and NET-FETCH-js/background.js-96 sit in the service worker. NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49 sit in the UI scripts. For a wallpaper that streams video, renders a side panel and shows local weather, remote asset loading is the feature working as described, and none of the six calls points at a host with a poor reputation.

The endpoint list is where the noise lives. sidepanel.open, sidepaneltoggle.is, bg.mp, ce.support, data.city, dy.th, v2.do and zh.ki are property access chains and string fragments lifted out of minified JavaScript, which is what you get when an extractor reads a dot as a domain separator. ǖ.so, յ.pa and كm.tl are not domains at all; they are non-Latin letters that ended up next to a dot. jquery.org and www.videolan.org are the only two entries with real owners, and both are open source projects, the jQuery library and the VideoLAN organisation behind VLC, whose code or credits ship inside the package.

The remaining 43 findings are code-smell hits at the lowest severity tier, in files that do what their names say. js/weather.js performs weather lookups, js/popup.js drives the popup, js/sidePanel.js draws the side panel. There are no credential reads, no cookie harvesting, no search engine overrides and no new tab replacement anywhere in the package, and nothing in js/background.js contacts a host outside the ones the developer intended to call.

A skeptic has a fair point. The publisher is listed as [email protected], an email address rather than a named studio. The extension borrows the title of a Netflix film it has no connection to, and it is a wallpaper that pulls video from a remote server, so a later update could change what it pulls. That is a reason to watch future versions, not a reason to flag this one. Version 1.1 contains no malicious behaviour to point at: no signature, no obfuscated payload, no exfiltration path, nothing in the code that acts on user data. If a future release adds a new endpoint, that endpoint deserves its own review.

The finding volume is what drove the score here, and the volume is largely mechanical. An IoC extractor running over bundled JavaScript will read every dot-separated token as a hostname, and a code-smell rule set will fire on any file that uses fetch or touches the DOM. Strip both, and what is left is a wallpaper extension doing wallpaper things.

Key Reasons

• Zero malware signatures and zero obfuscation across all 123 findings
• The six network findings are NET-FETCH calls in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, consistent with a video wallpaper and weather widget
• Reported endpoints such as sidepaneltoggle.is, bg.mp and ǖ.so are minified-JS fragments and non-Latin characters misread as hostnames
• jquery.org and www.videolan.org are legitimate bundled open-source references
• No permissions, no host permissions, no credential or cookie access in the package

False Positive Considerations

• IoC extractor reading dot-separated tokens in minified JavaScript as domains (sidepaneltoggle.is, bg.mp, ce.support)
• Non-Latin character sequences glued to dots and reported as hostnames (ǖ.so, յ.pa, كm.tl)
• 43 low-severity code-smell hits firing on ordinary DOM and fetch usage
• Legitimate bundled library references (jquery.org, www.videolan.org) counted as network endpoints

Reviewed 2026-10-13; recommended action: suppress false positive; model confidence 82%.