Anime Girl JJK Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension declares no permissions and no host permissions. That is the most important fact in the package. A Chrome extension without tabs, cookies, storage or any host pattern cannot read page content, reach session cookies, or inspect browsing history. What Anime Girl JJK Live Wallpaper actually does lines up with its manifest: it swaps the new tab for a wallpaper picker and adds a weather strip, which is why js/weather.js, js/sidePanel.js and js/popup.js exist in the source tree.

Five network findings cover the outbound surface: NET-FETCH-js/background.js-51, NET-FETCH-js/background.js-65, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. A wallpaper has to be downloaded and a forecast has to be requested, so fetch calls in a background worker, a popup, a side panel and a weather module are the expected shape of this code. None of the five findings records a destination host, and with an empty host_permissions array the browser blocks any cross-origin request that the far end does not explicitly allow by CORS.

The 452 network indicators that dominate the count do not describe traffic. The listed hosts read like 0f.dj, 0l.qa, 0ub.sv, 4h.bb and 0ʶ.jo. Those have the shape of two-letter fragments pulled out of minified string tables by regex, and 0ʶ.jo carries a Unicode modifier letter where a TLD would sit, which no registry delegates. Fragments of this shape appear whenever the extractor walks a bundle with long string constants. Treating the list as 452 distinct destinations overstates the extension's reach by roughly two orders of magnitude.

The 42 remaining items are low-severity code-quality matches: eval-adjacent patterns, weak randomness, that family of rule. No malware signature fired anywhere in the package, no obfuscation was detected, and there are no dependency, secret or tool-poisoning findings. For an extension that ships a wallpaper gallery and a weather widget, minified library code producing that profile is what we expect to see.

A skeptic would point at the weakest signals: the publisher is a Gmail address rather than a named developer, the listing has zero users, and NET-FETCH-js/background.js-51 in a service worker is exactly where a phone-home call would live if one existed. That reading is fair as far as it goes, and it is why this is not a clean pass. What keeps it short of confirmed risk is the permission set. Without host permissions or any API access, a background fetch can send only what the extension already holds, and what it holds is a wallpaper preference and an approximate location for the forecast. The two-letter host fragments also fail the basic test of resolution, which undercuts the exfiltration theory that depends on them.

Capturing the literal request URLs at js/weather.js:49 and js/background.js:51 during a runtime pass would close the remaining gap. Until then the evidence describes an ordinary low-permission new tab extension.

Key Reasons

• Empty permissions and host_permissions arrays leave the extension no path to cookies, page content or history
• The five NET-FETCH findings sit in background, popup, side panel and weather modules, which matches a wallpaper gallery plus forecast widget
• The 452 IoC entries are malformed fragments such as 0f.dj and 0ʶ.jo, not resolvable destinations
• Zero malware-signature, zero obfuscation, zero dependency and zero secret findings across the package
• The 42 remaining findings are low-severity code-quality matches of the kind minified library code always produces

False Positive Considerations

• XIOC regex extraction lifting two-letter string fragments out of minified JavaScript
• Low-severity code-smell rules firing on bundled library code
• IoC volume inflating the total finding count without adding behavioral evidence
• Fetch findings recorded without destination hosts, which reads as unknown exfiltration when it is only an unlogged argument

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 72%.