Satoru Gojo Rose Live Wallpaper New Tab

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Satoru Gojo Rose Live Wallpaper New Tab does one thing: it swaps Chrome's new tab page for a video wallpaper. The capability surface is small. The manifest requests no permissions and no host permissions, which means the extension has no route to cookies, browsing history, open tabs, bookmarks or the text of pages you visit. A new tab override is a manifest key, not a permission, so that empty list fits the product.

The six network findings are all plain fetch calls: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. The file names map to the feature set. background.js handles wallpaper preloading, popup.js and sidePanel.js pull thumbnails and catalogue entries, and weather.js at line 49 does what its name says. Nothing in those paths reads credentials, and with no host permissions the code cannot attach sessions from other origins.

The 482 indicator-of-compromise entries are why this package looks alarming at a glance, and they are the weakest part of the evidence. Read the strings: 2ц.lr carries a Cyrillic ц, 4hě.mx carries ě, 4رl.gg carries an Arabic ر, and a-.cn has a hyphen sitting right before the TLD. None of these is a registrable domain. They are four to six character fragments the extractor carved out of minified JavaScript and tagged with a country-code suffix. The count measures how tightly the bundle is minified.

The 46 code-smell hits are low severity and fire on ordinary JavaScript patterns. Zero malware signatures matched across the package, zero obfuscation findings appeared, and no secrets were found. The publisher name is a contact address at gameograf.com, and the extension name describes a character wallpaper rather than mimicking a well-known product, so there is nothing pointing at impersonation either.

A skeptic would point out that a new tab replacement is the classic shape of a browser hijacker, and that 534 findings is a large number. That objection is fair in general and wrong here in specific. Hijacking leaves fingerprints: a custom search URL, a new tab document that redirects to a monetized domain, dynamic URL construction feeding a query endpoint. None of those show up. There is no search override and no redirect chain. The large number comes from minification plus a domain extractor that does not validate its output.

What would change this read is a resolved fetch destination pointing at a tracker, or a manifest that turns out to request tabs or all-sites access. Neither is present in this evidence.

Key Reasons

• Zero malware signatures and zero obfuscation findings across the whole package, including js/background.js and js/sidePanel.js
• Manifest declares no permissions and no host permissions, so there is no path to cookies, history or page content
• All 482 IoC entries are minified-code fragments with impossible domain characters (2ц.lr, 4hě.mx, 4رl.gg) or broken syntax (a-.cn)
• The six NET-FETCH findings in background.js, popup.js, sidePanel.js and weather.js match wallpaper and weather loading for a new tab page
• 46 code-smell hits are all low severity and match ordinary JavaScript patterns

False Positive Considerations

• IoC extractor carving 4-6 character fragments out of minified JavaScript and labelling them as domains
• Low-severity code-smell rules firing on any non-trivial JavaScript bundle
• Generic NET-FETCH detections on ordinary image and weather fetch calls
• Finding count inflated by bundle size rather than by behavior

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 82%.