JJK Sukuna X Labubu Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Six findings, all rated medium, all the same kind. NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82 and NET-FETCH-js/background.js-96 mark three fetch() calls inside the service worker. NET-FETCH-js/popup.js-39 and NET-FETCH-js/sidePanel.js-362 do the same in the two UI scripts. NET-FETCH-js/weather.js-49 sits in the file named for the weather widget, which is the least surprising place in any extension to find an outbound request.

The detector fires on the fetch API itself. It reports the line where a request starts, not where the request goes. Nothing else in the scan fills that gap: no domains appear in the network endpoint list, and the manifest declares neither permissions nor host permissions. That last detail cuts both ways and is worth being explicit about. Under Manifest V3 an extension that reaches a public weather service or image CDN does not need a host permission when the endpoint answers with permissive CORS headers, so an empty permissions block fits a working product. It also fits requests whose target we cannot see.

What the scan does not contain matters as much as what it does. There are no malware signatures, no obfuscation findings, no secrets, no dependency findings, no manifest-analysis findings and no indicators of compromise. A wallpaper extension that wanted to hijack search would normally leave a trace in the manifest, a chrome_settings_overrides block or a content script injected into every page. Neither shows up. The developer string [email protected] is an email address rather than a company name, and the install base is 72 users at version 1.1.2, which is small and unremarkable rather than the freshly-updated-anonymous-release shape that usually accompanies an obfuscated payload.

A skeptic would push back here: a new tab replacement runs on every new tab, and it loads remote content we cannot name. That is a fair description of the risk surface. The counter is that the evidence for abuse is a set of fetch calls with no destination, no signature and no obfuscation. Flagging an extension for calling fetch in js/weather.js is a claim about the scanner's rule set, not about the extension's behavior. The rule cannot tell a weather API from an exfiltration endpoint, so it reports both. To close the gap you would load the extension unpacked, open a new tab and read the network panel for the actual hosts behind the calls in js/background.js. Until then the destination is unknown, and unknown is not the same as hostile.

Key Reasons

• All six findings are NET-FETCH detections raised on ordinary application scripts (js/background.js, js/popup.js, js/sidePanel.js, js/weather.js), which is a known generic false-positive source.
• Zero malware signatures, zero obfuscation findings, zero secrets, zero dependency findings and zero IoCs across the whole scan.
• The manifest declares no permissions and no host permissions and no network endpoints were extracted, so no suspicious domain exists to act on.
• The fetch in js/weather.js matches the extension's stated weather widget rather than a credential or tracking endpoint.
• Version 1.1.2 with 72 users does not fit the recently-updated, anonymous, obfuscated profile.

False Positive Considerations

• Generic NET-FETCH rule fires on the fetch API itself, not on a destination
• Empty permissions and host_permissions lists mean endpoint extraction produced nothing to evaluate
• Weather-widget code (js/weather.js) legitimately performs outbound requests
• Finding volume is six medium network notes with no corroborating signature, obfuscation or IoC

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 74%.