Sydney Sweeney Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension replaces the new tab page with looping HD video of its namesake celebrity. It ships four scripts that matter here: js/background.js, js/popup.js, js/sidePanel.js and js/weather.js, under a manifest that declares no permissions and no host permissions. Version 1.1.2 has 48 users and is published under the contact address [email protected]. A video wallpaper and a weather widget explain the moving parts without needing access to the pages anyone browses.

Six network findings mark real fetch() calls: NET-FETCH-js/background.js-63, -82 and -96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. None of them names a destination. The three in background.js plus the one in weather.js line up with a wallpaper updater and a forecast lookup, which is what the store listing promises.

The 86 indicators of compromise are the weakest part of the case. Reading the recovered strings, most are two-to-four character fragments such as bg.mp, d4.tr, kk.aw, nq.cw and ul.me. Those pieces come out of minified property chains, where the extractor cut them from longer expressions and read the leftovers as hostnames. Two entries, jquery.org and ce.support, are plausible domains, and jquery.org belongs to the jQuery project, a routine bundled library reference. Two more, sidepanel.open and sidepaneltoggle.is, are the Chrome side panel API and a boolean check garbled into pseudo-domains.

What the scan did not find carries as much weight. No malware signature matched, no obfuscation was detected, no embedded secret was pulled out, no dependency finding fired and no tool-poisoning rule hit. The 44 code-smell matches are low severity pattern checks that fire on packed JavaScript of any kind.

A skeptic can build a case the other way. A celebrity-named new tab wallpaper from an address-only publisher, with a weather module nobody asked for, is the exact shape of a monetized tab replacer, and the empty permissions block suggests the manifest was only partly read, so a chrome_url_overrides entry or a remotely loaded page cannot be ruled out from this data. That reading is fair. The problem is that none of it is in the evidence. A hijacker needs a search domain or a redirect target, and the recovered strings contain nothing of the kind: no query host, no search template, no analytics endpoint beyond generic infrastructure. The gap is in what the scan resolved, and it is why this verdict carries a hedge rather than a clean bill.

The test is small. Capture the outbound requests fired from js/weather.js:49 and js/background.js:63-96 on a fresh install. If they land on a weather API and a video CDN, nothing else here is worth chasing.

Key Reasons

• No malware signature, no obfuscation, no embedded secret and no dependency finding across all 136 items.
• All six network findings are fetch() call sites (js/background.js:63/82/96, js/popup.js:39, js/sidePanel.js:362, js/weather.js:49) with no destination resolved, matching the wallpaper download and weather lookup the description promises.
• The 86 IoC entries are dominated by 2-4 character fragments (bg.mp, d4.tr, kk.aw, nq.cw) and API references (sidepanel.open, sidepaneltoggle.is) produced by minified code, not by real hosts.
• The manifest declares no permissions and no host permissions, so no access to cookies, history or page content is requested.
• Celebrity wallpaper new-tab extensions are a low-quality niche, but no search template, redirect target or tracking domain appears in any recovered string.

False Positive Considerations

• IoC extractor splitting minified property chains into 2-4 character pseudo-domains
• Low-severity code-smell rules firing on packed JavaScript (44 hits)
• Every network finding has an empty description, so no request destination was ever resolved
• Bundled jQuery reference surfacing as jquery.org

Reviewed 2026-10-17; recommended action: monitor; model confidence 75%.