Spider-Man Night City Watcher Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

The extension 'Spider-Man Night City Watcher Live Wallpaper' by developer [email protected] presents a high finding count (379 total) but lacks any high-confidence threat indicators. The 364 IoC findings are dominated by benign infrastructure and false positives. Specifically, fonts.gstatic.com and jquery.org are legitimate Google CDN and library domains expected in any web-based extension. The findings o.call and oe.flat.call are property access chain false positives where the XIOC extractor misread JavaScript object property access (e.g., object.call()) as domain names.

The 15 code-smell findings are classified as low severity and per CVEQ documentation, code-smell rules like postinstall_*, credential_*, and code-quality rules fire on almost any non-trivial JavaScript. These are documented noise sources that should not drive verdicts. Critically, there are zero malware signatures, zero obfuscation findings, and zero network behavior findings—three key indicators that would signal actual malicious intent.

The extension's stated purpose (live wallpaper for new tab page) aligns with the benign domains detected. A visual extension would reasonably load web fonts from Google and jQuery for DOM manipulation. The short TLD domains (p.im, r.lc, s.gp, g.tr, ao.br, cu1.ec, 7.nc) are ambiguous—they could be CDN or analytics endpoints, but without malware signatures or obfuscation co-located with these domains, they do not constitute strong evidence of malicious behavior.

The strongest counterargument is that the developer uses a personal Gmail address rather than a verified company domain, which could indicate an unverified publisher. However, with only 36 users, this extension has not achieved widespread distribution that would make it a significant threat vector. The absence of malware signatures, obfuscation, or credential-theft indicators means the extension does not exhibit the behavioral patterns of confirmed malicious extensions. The high finding count is explained by known false-positive patterns in the CVEQ pipeline, not by actual malicious code.

Key Reasons

• Zero malware signatures detected across all scanned files
• Zero obfuscation findings despite high IoC volume
• IoC count driven by benign CDNs (fonts.gstatic.com, jquery.org) and property access chains (o.call, oe.flat.call)
• Code-smell findings are documented as noise in CVEQ analysis
• Extension functionality matches expected behavior for a live wallpaper

False Positive Considerations

• IoC extractor property access chain false positives (o.call, oe.flat.call)
• Benign CDN domains (fonts.gstatic.com, jquery.org)
• Code-smell rules firing on legitimate JavaScript
• High finding count from bundled dependencies without malware signatures

Reviewed 2026-04-29; recommended action: suppress false positive; model confidence 72%.