Luffy vs His Soul Epic One Piece Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension, "Luffy vs His Soul Epic One Piece Live Wallpaper" by developer [email protected], triggers 246 total findings but the evidence reveals systematic false positive patterns rather than actual malicious behavior.

All 231 IoC findings are XIOC extractor garbage. The finding "XIOC-DOMAIN-f.teardown.call" from extracted_from_files is not a domain—it is JavaScript property access chain syntax. Similarly, "XIOC-DOMAIN-c.predispatch.call", "XIOC-DOMAIN-ce.event.handlers.call", "XIOC-DOMAIN-e.name", and "XIOC-DOMAIN-this.show" are all variable.property.method patterns that the XIOC tool misidentifies as domains. None contain valid TLDs or represent actual network destinations. This is a documented false positive pattern in CVEQ analysis.

The extension has zero network findings, meaning no actual outbound connections were detected to suspicious domains. There are zero obfuscation findings, ruling out steganography or payload hiding. There are zero code-smell findings, which would typically accompany obfuscated malware. The extension serves a legitimate purpose as a live wallpaper for anime fans, which is a valid use case for browser extensions.

The 15 high-severity malware-signature findings create uncertainty. However, without specific signature names or file paths in the evidence, and given that all IoC findings are clearly false positives, these signatures likely match generic JavaScript patterns rather than actual malware families. The absence of obfuscation findings contradicts the typical malware profile where signatures co-locate with obfuscation in the same file.

Counterargument: A skeptic could argue that 15 high-severity malware-signature findings warrant escalation regardless of IoC quality. However, malware-signature findings without accompanying obfuscation, network activity, or credential theft patterns are often overly broad YARA rules matching benign JavaScript. The extension's low user count (48 users) and generic Gmail developer address are common for legitimate indie developers, not indicators of malicious campaigns. If these were real malware signatures, the evidence would show specific file paths containing the signatures and corresponding network exfiltration findings, neither of which exist here.

The verdict remains likely_false_positive because the finding nature—not the count—determines risk. All IoCs are XIOC garbage, no network activity exists, and no obfuscation is present.

Key Reasons

• All 231 IoC findings are property access chain false positives (f.teardown.call, c.predispatch.call, this.show)
• Zero network findings detected—no actual outbound connections to suspicious domains
• Zero obfuscation findings contradicts typical malware profile
• Extension serves legitimate purpose as anime live wallpaper
• Malware-signature findings lack specific file paths or signature names

False Positive Considerations

• XIOC property access chain extraction (f.teardown.call, ce.event.handlers.call)
• Generic malware-signature YARA rules without file path specificity
• Finding count inflation from single file extraction

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 75%.