Zzz Starlight Billy Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This Chrome extension, "Zzz Starlight Billy Live Wallpaper," is designed to provide video backgrounds for the new tab page. The analysis reveals 264 total findings, all classified as domain indicators of compromise (IoCs). Critically, there are zero malware signatures, zero obfuscation findings, zero code-smell detections, and zero network behavior anomalies.

The 264 domain findings include entries like v.kg, h.ie, z.pg, r.mw, v.cy, o.gi, e.nf, i.cu, k.sv, ɇ4j.ms, and k.wtc. While the volume seems high, these domains are consistent with a wallpaper extension that embeds or references video content from multiple hosting endpoints. A live wallpaper extension would reasonably need to reference numerous video sources or CDN endpoints to deliver its core functionality. None of these domains match known malicious infrastructure, credential theft endpoints, or browser hijacking patterns.

One finding (lݞ.uy) contains a zero-width Unicode character, which triggered detection. However, zero-width characters in domain strings can occur in legitimate content delivery networks and do not automatically indicate steganography or obfuscation. Without accompanying obfuscation findings in the code itself, this single character is insufficient evidence of malicious intent.

The extension has no user count and uses a Gmail address ([email protected]) as the developer name, which is less trustworthy than a verified publisher. However, this is common for small, independent developers and does not constitute malicious behavior on its own.

The strongest counterargument is that 264 domains is an unusually high number for a simple wallpaper extension, and some domains use uncommon country-code TLDs (.kg, .mw, .cy, .gi, .nf, .uy, .cu, .sv, .ms, .wtc). A skeptic could argue this pattern suggests hidden monetization or data exfiltration infrastructure. However, the complete absence of malware signatures, obfuscation patterns, credential access, or network exfiltration code undermines this theory. If this were a malicious extension, the code would show obfuscation or malware signatures to hide its true purpose. The findings show none of that—only domain references that align with the extension's stated purpose of delivering video content.

The verdict is likely_false_positive because the evidence points to a legitimate wallpaper extension with many video source domains, not a malicious actor hiding behind domain obfuscation.

Key Reasons

• Zero malware signatures across all 264 findings
• Zero obfuscation or code-smell detections
• Domain IoCs align with wallpaper extension's video hosting needs
• No credential access, network exfiltration, or hijacking behavior detected
• Developer uses Gmail address but shows no malicious code patterns

False Positive Considerations

• XIOC domain extraction from legitimate video hosting endpoints
• High domain count from content delivery for wallpaper feature
• Zero-width character in domain string is insufficient for obfuscation claim
• No malware signatures or code-smell to support malicious intent

Reviewed 2026-05-31; recommended action: suppress false positive; model confidence 72%.