Demon Slayer Akaza Sacred Sword Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Demon Slayer Akaza Sacred Sword Live Wallpaper is a Chrome new tab replacement that loops animated Demon Slayer artwork. Its manifest declares no permissions and no host permissions. Nothing in that grant list touches tabs, cookies, history, downloads, webRequest or page content, so the extension has no path to observe what you do outside its own new tab page.

The finding set is 199 medium-severity entries in the ioc category and 19 low-severity code-smell entries. Nothing else fired: zero malware-signature, zero malware, zero obfuscation, zero network, zero manifest-analysis, zero secret, zero dependency, zero tool-poisoning. Read the ioc titles and the pattern is obvious. XIOC-DOMAIN-ǚ.gg, XIOC-DOMAIN-yի.ye, XIOC-DOMAIN-o.uy, XIOC-DOMAIN-b.bi, XIOC-DOMAIN-v.mp and XIOC-DOMAIN-tw.fj are two-character labels with Chinese Pinyin (ǚ), Armenian (ի), Hebrew (ל in aל.ru) and Cyrillic (ј in duј.bm) characters spliced into them. Registrable domains do not look like this. The identical entry appears in the network_endpoints list (5h.ms, 6obi3.ss, 7p7.mq, 7ټ.lb), which is the tell: these are identifier fragments out of minified JavaScript that the extractor parsed as hostnames. Every ioc finding carries file_path "extracted_from_files" rather than a real location, so none of them can be traced to a line of code that dials out.

One URL in the set is real: XIOC-URL-http://www.videolan.org/x264.html. That is the x264 encoder reference page, which shows up in licence headers and build metadata of bundled H.264 video libraries. For an extension whose entire job is playing a looping video wallpaper, a bundled codec is the expected shape of the package. The 19 code-smell findings are the usual postinstall and credential rules that match basic fetch, exec, crypto and process.env patterns in any non-trivial bundled JavaScript, and they carry severity low for that reason.

Here is the strongest argument against this reading. The publisher is a bare Gmail address with no verified identity, the extension has 0 users, the name leans on a copyrighted anime character, and 199 medium-severity domain hits is a lot to wave away. A brand new anonymous wallpaper with hundreds of suspicious domains is exactly how hijackers look on day one. Two facts undercut it. First, the domains are not plausible hostnames at all, so the count reflects the extractor, not the code. Second, the manifest grants nothing. An extension with no host permissions still can request URLs from its own new tab page, but if it were calling 3r.bt or custom.show, we would expect network findings tied to a file, and there are none. What would settle it: the manifest's chrome_url_overrides entry and a runtime capture of the new tab page's outbound requests. Until then, the evidence points at a bundled video codec and a noisy scanner.

Key Reasons

• Manifest declares no permissions and no host permissions, so the extension has no access to tabs, cookies, history or page content
• Zero malware-signature, malware, obfuscation, network, manifest-analysis, secret and tool-poisoning findings across 218 total
• All 199 ioc findings are Unicode-garbled two-letter pseudo-domains such as XIOC-DOMAIN-ǚ.gg, XIOC-DOMAIN-yի.ye and duј.bm, the signature of the XIOC extractor misparsing minified JavaScript
• The only real URL is XIOC-URL-http://www.videolan.org/x264.html, the x264 codec reference page expected in a bundled H.264 video library for a live wallpaper
• The 19 remaining findings are low-severity code-smell rules that fire on any bundled JavaScript

False Positive Considerations

• XIOC domain extraction turning minified JavaScript fragments with non-Latin characters into 199 fake hostnames
• Code-smell rules matching generic fetch, exec and crypto patterns in bundled JavaScript
• Bundled H.264/x264 video codec metadata producing the videolan.org URL
• Finding count inflated by dependency bundle contents rather than first-party behaviour

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 82%.