One Piece Franky RAM TRX Live Wallpaper

AI Security Review

Evidence context: threat category unknown malware; evidence quality weak.

The extension "One Piece Franky RAM TRX Live Wallpaper" presents an ambiguous security profile that warrants further investigation. The evidence bundle contains 429 medium-severity IoC findings, all categorized as XIOC-DOMAIN detections for short, single-character subdomains (e.g., w.do, jv.cn, p.by, 5.ad, yv.bn, 1.cz, t.mm, z.vu, p.ck, q.py, ϳ.gy, a.id). These domains are extracted from files but lack corresponding network findings showing actual communication.

Critical Missing Evidence: The findings_summary shows zero malware signatures, zero obfuscation findings, and zero network findings. This absence is significant—if this were malicious infrastructure, we would expect to see actual network behavior captured, not just static IoC extractions. The 19 low-severity code-smell findings are insufficient to drive a verdict, as these are documented false-positive sources that match common JavaScript patterns.

Suspicious Pattern: The domain pattern (single-character subdomains across diverse TLDs) is characteristic of either ad tracking networks, URL shorteners, or potentially C2 infrastructure. Without runtime analysis showing whether these domains are actually contacted and for what purpose, the intent cannot be determined. The extension description claims to provide "live wallpapers" which could legitimately require external image fetching, but 429 distinct domains is excessive for that purpose.

Publisher Concerns: The developer is listed as "[email protected]" (anonymous email) with only 10 users. This combination—anonymous publisher, low user count, and suspicious IoC volume—creates genuine uncertainty about the extension's legitimacy.

Counterargument: A skeptic might argue this is a false positive driven by XIOC extraction noise, given the absence of malware signatures and obfuscation. This has merit—the XIOC extractor is documented to produce false positives, and short domain patterns can appear in minified code. However, the volume (429 findings) and consistent pattern (single-character subdomains) exceed typical false-positive noise levels. The verdict remains needs_follow_up because runtime analysis is required to determine if these domains represent actual malicious infrastructure or benign ad tracking.

Recommendation: Runtime analysis should capture actual network traffic to verify whether these domains are contacted, what data is transmitted, and whether the extension exhibits browser hijacking or data exfiltration behavior.

Key Reasons

• 429 IoC findings for short-domain pattern without malware signatures
• Zero obfuscation or network findings despite high IoC count
• Anonymous developer (email-only) with only 10 users
• XIOC extraction without runtime network behavior confirmation

False Positive Considerations

• XIOC-DOMAIN extraction without network findings
• Short domain patterns can be ad tracking or URL shorteners
• Code-smell findings (19 low-severity) are documented noise
• No malware signatures or obfuscation detected

Reviewed 2026-04-27; recommended action: runtime analysis; model confidence 60%.