Unleash the King of Curses with Sukuna Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This live wallpaper extension for Chrome shows 203 IoC findings and 34 code-smell findings, but no malware signatures or obfuscation. The IoC findings include domains like chrome.google.com (legitimate Google infrastructure), t.using.call (property access chain misread as domain), and v.global (generic pattern). These match documented XIOC extractor false positive patterns where property chains like b.call, h.next, g.id are incorrectly flagged as domains.

The network findings show fetch calls in js/newsBar.js:17, js/script.js:45, and js/popup.js:29. These file names suggest legitimate functionality for a wallpaper extension that may load content or check for updates. The code-smell findings (34 total, all low severity) match the postinstall_* and credential pattern rules that fire on almost any non-trivial JavaScript.

The extension has developer attribution ([email protected]), a clear description matching its stated purpose (Sukuna anime live wallpaper), and no obfuscation. The 89 user count is low but not concerning for a niche anime-themed extension.

Strongest counterargument: A skeptic might argue the 203 IoC findings indicate hidden malicious network activity. However, finding COUNT is explicitly not evidence per CVEQ guidelines. The NATURE of these findings matters: they include known benign domains (chrome.google.com), obvious false positives (t.using.call), and no specific suspicious domains that would indicate credential theft, browser hijacking, or data exfiltration. Without malware signatures, obfuscation, or concrete evidence of harmful behavior, the IoC volume reflects extractor noise rather than actual threats.

Key Reasons

• Zero malware signatures detected
• IoC findings match known XIOC false positive patterns (property chains, generic domains)
• Network calls in legitimate file paths (newsBar.js, script.js, popup.js)
• No obfuscation detected
• Developer attribution present ([email protected])

False Positive Considerations

• XIOC property chain misreads as domains (t.using.call)
• Legitimate infrastructure domains (chrome.google.com)
• Code-smell rules firing on basic JavaScript patterns
• Generic domain patterns (v.global, i.data)

Reviewed 2026-04-29; recommended action: no action; model confidence 75%.