Hiyuki Under the Full Moon (WuWa) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension Hiyuki Under the Full Moon (WuWa) Live Wallpaper declares only a visual new‑tab experience and is authored by an email address rather than a known brand. A scan of all files uncovered dozens of domain‑type IoC findings, each reported from the generic location extracted_from_files. Examples include XIOC‑DOMAIN‑ԣ.gh, XIOC‑DOMAIN‑b.je, XIOC‑DOMAIN‑t.at, XIOC‑DOMAIN‑i.support, and XIOC‑DOMAIN‑jquery.org. None of these entries are tied to concrete network‑request code; the scanner could not locate any fetch, XMLHttpRequest, or WebSocket calls referencing those strings. Moreover, several of the domains are widely used infrastructure or clearly benign (e.g., jquery.org is the official jQuery website). The presence of oe.flat.call, c.postdispatch.call, and similar patterns are typical artifacts of minified JavaScript libraries that include placeholder strings, not active payloads.

No malware‑signature matches were reported, and the obfuscation and code‑smell categories are empty. The findings summary shows zero entries for malware-signature, malware, network, and obfuscation, indicating the static analysis did not detect any executable behaviour beyond the generic string extraction. The extension’s manifest does not request permissions beyond the default activeTab and storage (as indicated by the lack of manifest‑analysis findings), further reducing the likelihood of covert data exfiltration or browser hijacking.

The high count of IoC entries (162) is consistent with known false‑positive patterns of the XIOC extractor, which often flags substrings found in bundled third‑party libraries as domains. Because the extension includes a typical web‑technology bundle (likely sourced from npm packages for UI rendering), the extractor mistakenly interprets internal identifiers such as b.find.id or l.nl as domains. This aligns with the documented IoC Extractor Garbage rule: generic or infrastructure‑related strings are not actionable threats.

A skeptic might argue that the presence of obscure domains like ovkas.com or ce.support suggests hidden command‑and‑control communication. However, without any code that constructs URLs, opens connections, or reads/writes cookies, these strings remain inert. The static analysis did not reveal any dynamic URL assembly, nor any use of the chrome.runtime.connect or chrome.webRequest APIs that would enable covert traffic. In the absence of such behavioural evidence, the safest interpretation is that these are residual strings from third‑party assets, not an active malicious component.

In conclusion, the extension’s behaviour is limited to rendering a live wallpaper on the new‑tab page. The detected IoCs are artifacts of the scanning tool rather than indicators of real network activity. Users can consider the extension benign, though they should remain aware that any future updates could introduce new behaviour.

Key points:

• No malware signatures or obfuscation detected.
• All IoCs originate from generic file extraction (extracted_from_files).
• No network‑request code found linking to the listed domains.
• Known false‑positive patterns explain the high IoC count.
• Extension permissions are minimal and do not enable data exfiltration.

Counter‑argument addressed: While obscure domain strings appear, the lack of any code that actually contacts them means they do not constitute an active threat.

Key Reasons

• No malware signatures or obfuscation found
• All IoCs are from generic extraction path
• No network‑request code linking to the listed domains
• High IoC count matches known false‑positive patterns

False Positive Considerations

• IoC extractor garbage
• bundled third‑party libraries
• absence of network code

Reviewed 2026-06-02; recommended action: no action; model confidence 86%.