Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by raw.githubusercontent.com
Gengar Pokemon 4K Live Wallpaper
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 9 months ago
- Version
- v3.6
- Artifact
- SHA256 C77…EF2
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
9 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | postinstall file download File download activity detected | 4 | js/script.jsjs/popup.jsjs/newsBar.js +1 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall obfuscation Code obfuscation techniques detected | 2 | img/bg.mp4js/jquery-3.7.1.min.js | Risky Plugins Authors FP 20% |
| HIGH | LocalStorageShouldNotBeUsed Session storage and local storage are HTML 5 features which allow developers to easily store megabytes of data client-side, as opposed to the 4Kb cookies can accommodate. While useful to speed applications up on the client side, it can be dangerous to store sensitive information this way because the data is not encrypted by default and any script on the page may access it. This rule raises an issue when the localStorage and sessionStorage API's are used. For more information checkout the OWSAP A3:2017 (https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html) advisory. | 4 | js/script.jsjs/createStickyNote.jsjs/popup.js +1 more | FP 5% |
| HIGH | SQLInjection SQL queries often need to use a hardcoded SQL string with a dynamic parameter coming from a user request. Formatting a string to add those parameters to the request is a bad practice as it can result in an SQL injection. The safe way to add parameters to a SQL query is to use SQL binding mechanisms. For more information checkout the CWE-564 (https://cwe.mitre.org/data/definitions/564.html) and OWASP A1:2017 (https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html) advisory. | 3 | js/script.jsjs/jquery-3.7.1.min.jsjs/todo.js | FP 10% |
| HIGH | NoUseWeakRandom When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead. For more information checkout the CWE-338 (https://cwe.mitre.org/data/definitions/338.html) advisory. | 2 | js/createStickyNote.jsjs/jquery-3.7.1.min.js | FP 5% |
| HIGH | postinstall network communication Network communication detected | 4 | newtab.htmlimg/bg.mp4js/jquery-3.7.1.min.js +1 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 14 | js/bg.jsjs/newsBar.jscss/style.css +11 more | Risky Plugins Authors FP 20% |
| HIGH | postinstall system command System command execution detected | 2 | img/bg.mp4js/jquery-3.7.1.min.js | Risky Plugins Authors FP 10% |
| HIGH | postinstall crypto operations Cryptographic operations detected | 2 | _metadata/verified_contents.jsonjs/jquery-3.7.1.min.js | Risky Plugins Authors FP 30% |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
9 rules(37 hits)Requested Permissions
2 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
This extension presents a classic false positive case driven by the CVEQ IoC extractor's documented noise patterns. The 507 IoC findings consist entirely of benign Google infrastructure domains (www.google.com, forms.google.com, photos.google.com, keep.google.com, news.google.com, www.gstatic.com, www.blogger.com) and property access chains misread as domains (ue.call, o.call, oe.flat.call) — both explicitly documented as IoC Extractor Garbage in the CVEQ false positive patterns. The single network finding at js/newsBar.js:17 shows a generic fetch call with no suspicious destination domain.
The 37 code-smell findings are classified as low severity and per the triage guidelines, "code-smell findings (severity=low, finding_type=code-smell) are NOISE." These match basic JavaScript patterns and do not indicate malicious behavior. Critically, there are ZERO malware signatures, ZERO obfuscation findings, and ZERO findings in credential_theft, browser_hijack, or data_exfiltration categories.
The extension's functionality aligns with its description: a Pokémon-themed live wallpaper extension. The name "Gengar Pokemon 4K Live Wallpaper" is descriptive without typosquatting any known extension. The developer email "[email protected]" is generic but not obviously malicious, and the 996 user count is modest without the "high user count + anonymous publisher" red flag pattern.
Counterargument: A skeptic might argue that 547 total findings with 507 IoCs represents significant risk regardless of their nature. However, finding COUNT is explicitly not evidence — finding NATURE is evidence. The IoC extractor produces massive false-positive volumes from Google domains and property access chains, as documented in the false positive patterns. A single specific suspicious domain would matter more than 10,000 garbage IoCs, and here there are ZERO specific suspicious domains — only Google infrastructure and false domain patterns. Without malware signatures, obfuscation, or actual suspicious behavior, the high finding count is a scoring artifact, not a security concern.
Key Reasons
- Zero malware signatures detected
- All IoCs are Google domains or property access chain false positives
- Zero obfuscation findings
- Extension functionality matches description
- Code-smell findings are documented noise
False Positive Considerations
- IoC extractor garbage (Google domains)
- Property access chains misread as domains (ue.call, o.call, oe.flat.call)
- Code-smell findings classified as noise
- Score inflation from finding volume
Reviewed 2026-04-29; recommended action: suppress false positive; model confidence 88%.
Source Code Not Available
Source code is not available for this version of the extension.