King Von Statue Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension 'King Von Statue Live Wallpaper' by developer [email protected] shows 341 total findings, but the evidence indicates these are predominantly false positives from known noise patterns.

The 324 IoC findings are classic XIOC extractor garbage. The majority of detected 'domains' are property access chains misread as domains: t.call, s.call, se.call, a.id, k.call, o.call, i.call, ae.call, and oe.flat.call are not real domains but JavaScript property access patterns (e.g., someObject.call). The only legitimate domains in the IoC list are jquery.org (a standard CDN) and ovkas.com (insufficient context to determine malicious intent). This pattern matches the documented XIOC false-positive behavior where property chains are extracted as suspicious domains.

The 17 code-smell findings are classified as low severity and match known noise patterns (postinstall, credential, or code-quality rules). Per the CVEQ guidelines, code-smell findings should NEVER drive a verdict as they fire on almost any non-trivial JavaScript.

Critically, there are zero malware signatures, zero obfuscation findings, and zero network findings. The extension has no evidence of credential theft, browser hijacking, proxyware functionality, or typosquatting. The developer uses a Gmail address rather than a company name, and the extension has 0 users, but these alone do not constitute malicious evidence.

The strongest counterargument to this verdict is the combination of a generic Gmail developer, zero user count, and the presence of ovkas.com in the IoC findings. A skeptic might argue these signals warrant caution. However, anonymous developers publish legitimate extensions, new extensions naturally have zero users, and ovkas.com without additional context (malware signatures, obfuscation, or network activity) is insufficient evidence of malicious behavior. The verdict remains likely_false_positive because the finding volume is driven by documented false-positive patterns rather than actual malicious indicators.

Key Reasons

• 324 IoC findings are property access chains (t.call, s.call, a.id) not real domains
• Zero malware signatures detected
• Zero obfuscation findings
• Code-smell findings are documented noise patterns
• No network activity or credential theft indicators

False Positive Considerations

• XIOC property chain misidentification as domains
• Code-smell findings classified as low severity noise
• High finding count from bundled code patterns
• IoC volume inflation from extractor garbage

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 70%.