Madara Uchiha (Naruto) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This listing is a Chrome new tab replacement that shows Madara Uchiha artwork and adds a weather module. Version 1.1.7 is published under [email protected], and the recorded install count is zero. The manifest data lists no permissions and no host permissions.

Five network findings name the places where the extension calls out: NET-FETCH-js/background.js-51, NET-FETCH-js/background.js-65, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. A wallpaper page has to fetch its images, and a weather widget has to fetch a forecast. js/weather.js:49 sits inside the weather module, which is the ordinary place for that API call. These findings record that a fetch happens; none of the titles carry the destination.

The bulk of the volume is the 443 indicator entries. The sample endpoints include 5γ.dz, 94㧢r.to, 2jq.kw, 9q.bb and 1d.cc. A Greek gamma and a CJK character inside a supposed hostname is proof that these strings were never addresses. The rest follow the same shape: one or two character labels on two letter country suffixes, which is what a scanner pulls out of compressed JavaScript when it reads variable chains and minified tokens as domains. Another 44 findings are code-smell matches, every one low severity, and they fire on ordinary function calls and string handling. Against 492 total findings, zero malware signatures matched and zero obfuscation was detected.

Nothing about the name points at impersonation. Madara Uchiha is a Naruto character, and no security vendor or popular extension uses that identity. There are no custom search domains, no history API findings, no new tab redirect to a monetized search page, and no cookie or credential access, which fits the empty permission list.

A skeptic would point at the shape of this thing: an anonymous Gmail publisher, a new tab page, a side panel, 443 external hosts, and outbound fetches whose destinations the scan does not record. New tab extensions with weather widgets and side panels are a known vehicle for ad injection and search hijacking. That reading is fair as a hypothesis, and it stays a hypothesis with no real domain, no redirect template and no malware signature behind it. The fastest way to close it is to read the fetch targets at js/background.js:51 and js/weather.js:49 directly.

What we have is a small, uninstalled wallpaper extension whose scan count comes from an extractor reading minified JavaScript. None of the findings show code that steals, redirects or hides.

Key Reasons

• 443 indicator entries are extractor artifacts: sample endpoints such as 5γ.dz and 94㧢r.to contain non-ASCII characters that cannot appear in a hostname
• Zero malware signatures and zero obfuscation findings across 492 total findings
• All 44 code-smell findings are low severity and match ordinary JavaScript patterns
• The five NET-FETCH findings sit in the wallpaper loader and weather module (js/weather.js:49), which need outbound requests
• No permissions or host permissions declared, so no access to cookies, history or tabs

False Positive Considerations

• IoC extractor reading minified JavaScript fragments as domains (5γ.dz, 94㧢r.to, 1d.cc)
• Low-severity code-smell rules matching ordinary function calls
• Network findings on fetch calls a wallpaper and weather new tab page requires

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 70%.