One Piece Luffy Gear 5 Run to Freedom Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

"One Piece Luffy Gear 5 Run to Freedom Live Wallpaper" is a Chrome new tab replacement. It swaps the default page for animated artwork. The manifest declares no permissions and no host_permissions, which lets it override the new tab page and nothing else. There is no access to browsing history, cookies, tabs or page content.

The scan produced 188 findings, and their shape says more than their number. Malware signatures: zero. Network findings: zero. Obfuscation findings: zero. Secrets: zero. Dependency findings: zero. What remains is 169 domain extractions plus 19 low-severity code-quality warnings.

Look at what the extractor pulled. The IoC titles read XIOC-DOMAIN-x.uk, XIOC-DOMAIN-q.cx, XIOC-DOMAIN-5a.ru, XIOC-DOMAIN-7c.lr, XIOC-DOMAIN-z.aw, XIOC-DOMAIN-j.td, XIOC-DOMAIN-i.mk. Each one is a two-character token, a dot and a country code. The endpoint list repeats the pattern with entries like 0uu.lt, 2e.tk, 4i.ag, cv.va, dg.pe and f1.lk. That is what a minifier leaves behind when string tables and regex literals get packed onto one line: a short key followed by a dotted suffix reads as a hostname to a pattern matcher. None of the extracted strings matches a host named anywhere in the package, and the package names no API host, analytics host or CDN.

XIOC-DOMAIN-dо.fk deserves a mention because it carries a Cyrillic о (U+043E) where a Latin o would go. Homoglyph substitution is a real typosquatting technique (С for C, а for a). Here the character sits inside a two-letter fragment with no brand behind it, so the homoglyph reads as an artifact of the byte sequence the extractor picked up, with no lookalike domain behind it.

The 19 code-smell findings are low severity and cover generic JavaScript habits such as eval usage and weak randomness. The platform tracks them as code-quality heuristics, separate from malware signatures, and the count tracks how much bundled script the wallpaper ships.

A skeptic would point at the publisher. [email protected] has no company behind it, no linked privacy policy, and the extracted fragments include .tk, .cx and .ru, TLDs with higher abuse rates. That is a fair concern about accountability, and it is the one thing here the package itself cannot settle. What would move this to a real finding is a manifest with host permissions to a named host, or a network finding showing a fetch call to a resolved endpoint. Neither exists. With no host permissions, the extension cannot make cross-origin requests at all, so those strings cannot be contacted even if they pointed somewhere. The name also borrows a franchise character, which is a trademark problem rather than a security one.

Key Reasons

• Zero malware signatures, zero network findings, zero obfuscation findings and zero secrets across 188 total findings.
• All 169 IoCs are short two-character fragments on country TLDs such as XIOC-DOMAIN-x.uk, XIOC-DOMAIN-q.cx and XIOC-DOMAIN-5a.ru, the shape minified string tables produce.
• No permissions and no host_permissions declared in the manifest, so the extension cannot make cross-origin requests.
• The remaining 19 findings are low-severity code-smell heuristics with no behavioral weight.
• Publisher is an anonymous Gmail address and user_count is 0, so no install base corroborates either direction.

False Positive Considerations

• XIOC domain extractor reading short minified string fragments on two-letter TLDs
• Homoglyph artifact: XIOC-DOMAIN-dо.fk contains a Cyrillic о inside a two-letter fragment
• Low-severity code-smell heuristic rules
• IoC volume inflating the total finding count

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 82%.