Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Valentines Day Loves Hart Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 2 weeks ago
- Version
- v2.2.2
- Artifact
- SHA256 B6C…14E
- Source
- Findings (non-IoC)
Is Valentines Day Loves Hart Live Wallpaper safe?
This extension replaces your Chrome new tab page with Valentine's Day wallpaper. The manifest in this scan lists no permissions and no host permissions, and the only addresses in its code that belong to the publisher are its own API at api.gameograf.com, plus a link to www.videolan.org, the VLC media player site.
The findings worth explaining are six fetch calls, including js/background.js:63 and js/weather.js:49. If those calls went to an address nobody could identify, they could mean the extension was sending data somewhere it should not. Here they match the extension's own described features, loading wallpaper images, a side panel and a weather module, and the API domain matches the developer address [email protected].
The rest of the long hostname list is not real. Entries like ļ.tt, טn.me, ѿz.iq and sidepanel.open come from packed JavaScript being read as if scrambled code fragments were web addresses. Nobody registers names like those, and they never reach the network. Alongside that, the scanner's code-quality checks fired on ordinary script patterns, which is why the finding count looks high for such a simple extension.
If the extension declared host permissions to domains other than its own API, that would be worth a second look. As it stands, the code, the endpoints and the stated purpose all point the same way.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall file manipulation | 14 | css/style.cssjs/todo.jsjs/calendar.js +11 more | - |
| LOW | postinstall crypto operations | 3 | _metadata/verified_contents.jsonjs/jquery-3.7.1.min.jsjs/script.js | - |
| LOW | postinstall network communication | 7 | js/countdownTimer.jsjs/chatgpt.jsimg/bg.mp4 +4 more | - |
| LOW | postinstall obfuscation | 4 | js/sidePanel.jsjs/background.jsnewtab.html +1 more | - |
| LOW | postinstall system command | 2 | img/bg.mp4js/jquery-3.7.1.min.js | - |
| LOW | postinstall file download | 5 | js/sidePanel.jsjs/background.jsjs/popup.js +2 more | - |
| LOW | SQLInjection | 3 | js/todo.jsjs/script.jsjs/jquery-3.7.1.min.js | - |
| LOW | NoUseWeakRandom | 2 | js/createStickyNote.jsjs/jquery-3.7.1.min.js | - |
| LOW | LocalStorageShouldNotBeUsed | 3 | js/createStickyNote.jsjs/todo.jsjs/script.js | - |
| LOW | postinstall persistence mechanism | 1 | js/background.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(44 hits)Requested Permissions
4 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
Valentines Day Loves Hart Live Wallpaper is a Chrome new tab replacement published under [email protected], sitting at version 2.2.2 with roughly 393 users. It swaps the default new tab for a Valentine's Day photo set, and the code the scanner flagged matches that job.
The behavioral findings are six network calls: three in js/background.js (lines 63, 82 and 96), one in js/popup.js:39, one in js/sidePanel.js:362 and one in js/weather.js:49. A background worker that loads wallpaper images, a popup, a side panel and a weather module each need to fetch something, and the locations line up with those features. The one endpoint in the list that belongs to the publisher is api.gameograf.com, which matches the developer address [email protected]. The other recognizable host is www.videolan.org, the VLC media player site, which is the kind of reference that shows up in code that plays local media.
Everything else in the endpoint list is noise from packed JavaScript. Entries such as ѿz.iq, ƀ.ms, ļ.tt, טn.me, xі.dk, ke.td, v9.mn, 2ls.do, if.gl, ce.support and xq.qa mix Cyrillic, Hebrew and Latin letters that no one registers as a domain. sidepanel.open and sidepaneltoggle.is are property access chains, not websites. This is the documented failure mode of the indicator extractor on minified bundles: single letters and member lookups get read as hostnames.
The risk model's specific hallmarks are absent. No malware signature matched anywhere in the extension. There is no obfuscation finding, no embedded secret, and no tool-poisoning finding. Nothing touches cookies, the history API, a query template or a custom search engine, which is what a new tab hijacker would need to monetize traffic. The low-severity matches that pad out the finding list fire on ordinary JavaScript patterns and carry no behavioral weight on their own.
A skeptic has one fair objection. Replacing the new tab page is the classic vector for monetized extensions, and this scan records no permissions and no host permissions in the manifest, so the manifest itself was not fully read. We cannot confirm from this evidence what the new tab page loads at runtime. That gap is real, but it points to a manifest re-read, not a malware verdict. A hijacker would show a search domain, a dynamic URL template, or history manipulation somewhere in js/background.js or js/sidePanel.js, and none of those appear. The single publisher-owned endpoint is coherent with the developer identity, and the flagged volume comes from the extractor misreading minified code rather than from anything the extension does.
What would change this call: a manifest showing host permissions to domains other than api.gameograf.com, or runtime traffic leaving for anything outside that API.
Key Reasons
- Six NET-FETCH findings in js/background.js:63, js/background.js:82, js/background.js:96, js/popup.js:39, js/sidePanel.js:362 and js/weather.js:49 correspond to the extension's stated wallpaper, side panel and weather features.
- The only publisher-owned endpoint, api.gameograf.com, matches the developer address [email protected]; the other recognizable host is www.videolan.org.
- Almost all listed hostnames (ѿz.iq, ƀ.ms, ļ.tt, טn.me, xі.dk, sidepanel.open) are minified-JavaScript fragments, not registrable domains.
- No malware signature, obfuscation, secret or tool-poisoning finding matched, and nothing touches cookies, the history API or a search engine template.
- Manifest permissions and host permissions came back empty, so the manifest itself was not fully parsed.
False Positive Considerations
- Indicator extractor reading minified-JS fragments and property chains as domain names
- Low-severity code-smell rules firing on ordinary bundled JavaScript
- Ordinary fetch calls to the developer's own API counted as network risk
- Finding volume inflating the score without any behavioral finding behind it
Reviewed 2026-10-17; recommended action: monitor; model confidence 76%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Minato And Naruto Live Wallpaper
[email protected]
Shoto Todoroki My Hero Academia Live Wallpaper
[email protected]
Ferrari Racer Live Wallpaper
[email protected]
BMW i7 Neon Red Cyberpunk Luxury Live Wallpaper
[email protected]
Winter Snowy House Day and Night Live Wallpaper
[email protected]
Sharingan Circle Naruto Shippuden Live Wallpaper
[email protected]