Angelic Sukuna Jujutsu Kaisen Live Wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

This extension presents a significant security risk despite lacking confirmed malware signatures. The core concern is the presence of 691 domain IoCs extracted from the extension files, with specific findings including XIOC-DOMAIN-q.be, XIOC-DOMAIN-vӻ.ge, XIOC-DOMAIN-ѹ.rw, XIOC-DOMAIN-顰.tz, XIOC-DOMAIN-m.gy, XIOC-DOMAIN-w.ma, XIOC-DOMAIN-p.kp, XIOC-DOMAIN-t.gp, XIOC-DOMAIN-ur.bh, XIOC-DOMAIN-v.co, XIOC-DOMAIN-t.hk, and XIOC-DOMAIN-k.pt. These domains exhibit characteristics of ad network infrastructure: single-character or two-character subdomains, diverse country-code TLDs (be, ge, rw, tz, gy, ma, kp, gp, bh, co, hk, pt), and non-ASCII characters (vӻ.ge, ѹ.rw, 顰.tz) that may indicate domain spoofing or encoding obfuscation.

A legitimate anime wallpaper extension should not require contact with 691 different domains. The extension's stated purpose—displaying "Sukuna's divine angelic cursed power" live wallpapers—has no technical need for this volume of domain connections. This mismatch between declared functionality and actual domain infrastructure is a strong indicator of adware or tracking behavior embedded in the extension.

The developer identity raises additional concerns. The extension is published under "[email protected]," a personal Gmail address with no company attribution or verification. Combined with zero user count, this suggests either a freshly published extension or one that failed to gain traction, both of which warrant scrutiny.

The 16 code-smell findings (severity: low) are known false-positive patterns per CVEQ documentation and do not drive this verdict. These match basic Node.js patterns and should be treated as noise. However, the domain IoCs are not false positives—they are not Google, CDN, analytics, or the extension's own service domains.

Counterargument: A skeptic might argue that without network findings or malware signatures, the verdict is premature. They could claim the domains are bundled assets or dead code. However, the sheer volume (691 domains) and their specific characteristics (short, varied TLDs, non-ASCII) are inconsistent with legitimate bundled dependencies. Ad blockers legitimately have high IoC counts because they embed blocklists, but a wallpaper extension has no reason to embed thousands of ad/tracking domains. The domain pattern itself is the evidence of suspicious behavior, regardless of whether active network calls are detected in the static analysis.

The absence of malware signatures does not rule out risk—this is consistent with adware/PUP behavior rather than traditional malware. The extension should be treated as confirmed_risk with adware classification until the developer can justify the domain infrastructure.

Key Reasons

• 691 domain IoCs with short, varied TLDs inconsistent with wallpaper functionality
• Non-ASCII domain characters (vӻ.ge, ѹ.rw, 顰.tz) suggesting potential domain spoofing
• Personal Gmail developer with no company attribution
• Zero user count indicates new or untrusted extension
• Extension category mismatch: wallpaper claims vs. ad/tracking domain infrastructure

False Positive Considerations

• Code-smell findings (16 low severity) are known FP patterns
• IoC count inflation does not indicate false positive—domain nature is suspicious

Reviewed 2026-04-27; recommended action: monitor; model confidence 78%.