Tentacles Sorceror Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Tentacles Sorceror Live Wallpaper renders animated flame artwork as a Chrome wallpaper, published under [email protected] at version 1.1.2. The manifest declares no permissions and no host permissions, so the extension has no route to page content, cookies or browsing history without the user opening its own popup or side panel. The network activity is small and concentrated: three fetch calls in js/background.js at lines 63, 82 and 96, one in js/popup.js:39, one in js/sidePanel.js:362 and one in js/weather.js:49. The destinations that hold up as real hostnames are api.gameograf.com and gameograf.com, the publisher's own service and the same domain in the developer contact, alongside chat.openai.com, www.blogger.com and youtube.com.

The scan found no malware. Malware-signature matches: zero. Obfuscation findings: zero. Secret findings: zero. Manifest-analysis findings: zero. Every medium-severity item is a generic fetch marker tied to one of the six call sites above, and all 43 low-severity items are code-smell rules that fire on ordinary JavaScript patterns. None of them describe behaviour, only a call site or a keyword.

The endpoint list is the loudest part and also the least reliable. sidepanel.open, sidepaneltoggle.is, bg.mp, ke.td, data.city, 1xy.gh and qϻ.au are not hostnames in this code. They are property chains and string fragments lifted out of bundled script, and qϻ.au is not valid domain syntax at all. Fifty extracted indicators sounds alarming until you read them. Remove the fragments and the list collapses to five named destinations.

One entry deserves a second look: jquery.org. The real jQuery library lives at jquery.com, so a request to the .org spelling would be a typosquat candidate. No fetch finding points there, and the empty host_permissions block would stop a cross-origin call anyway. If a later version wires jquery.org into a live fetch, that would change this assessment.

A skeptic would point at chat.openai.com and ask why a wallpaper talks to an AI endpoint, then read the three background fetches as exfiltration. It is a fair question. The answer is that the capability is not present: with an empty permission set the extension cannot read the page you are on, and no content-script, cookie or clipboard finding appears anywhere in the scan. A publisher with its own API domain, a side panel and a weather module is a plausible shape for a wallpaper app with widgets, and nothing in the files does more than that.

Key Reasons

• No malware signatures, no obfuscation and no secret findings across 99 items; every medium finding is a generic fetch marker on a named call site.
• Network destinations resolve to the developer's own domain (api.gameograf.com, matching [email protected]) plus known sites such as youtube.com and www.blogger.com.
• Declared permissions and host_permissions are both empty, so no page-content, cookie, tab or history access is granted.
• Most listed endpoints (sidepanel.open, sidepaneltoggle.is, bg.mp, ke.td, qϻ.au) are JavaScript fragments rather than hostnames.
• Store listing has zero users and a description and version that match the artwork on the package.

False Positive Considerations

• IoC extractor reading property chains and string fragments as domains (sidepanel.open, bg.mp, ke.td, qϻ.au)
• Generic NET-FETCH markers attached to normal API calls in js/background.js and js/weather.js
• 43 low-severity code-smell rules that fire on any non-trivial JavaScript
• High finding volume with zero critical or high severity items

Reviewed 2026-10-17; recommended action: suppress false positive; model confidence 75%.