AI Security Review

Evidence context: threat category none; evidence quality moderate.

Aquarium Live Wallpaper 2.5.2

Aquarium Live Wallpaper (developer contact [email protected], 301 users) describes itself as an HD video wallpaper for the Chrome new tab page. Across 300 findings there is not one malware match, not one malware-signature match, and no obfuscation, secret, dependency or tool-poisoning finding. What remains is 249 indicator entries, 45 code-smell notes and six network findings.

The six network findings are plain fetch sites inside the extension's own scripts: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. A product that streams video into a new tab and shows a forecast has to make requests, and these line numbers sit in exactly the files that would do it.

The 249 indicators are the weakest part of the evidence. The recorded endpoint list reads 4z.bo, 9y.ba, du6.br, 2a.bw, 5x.tl, 9k.bn. Those are two-letter suffix-shaped fragments, not services. Two of them carry characters no registrar sells in that position: 2jދn.nr holds a Thaana letter (U+078B) and 9ʔ.sg holds a glottal stop (U+0294). Strings like that come from a regex walking minified JavaScript and stopping at the wrong byte. Even the two plausible entries, ce.support and data.city, are bare hostnames with no path and no tie to a wallpaper product. The developer's own domain, gameograf.com, appears nowhere in the list, so the list is not a faithful record of the extension's traffic.

The 45 code-smell findings are low severity and map to no malware family. They land in the same bucket as every minified script.

The strongest case against this reading is the manifest. The scanned profile records no permissions and no host permissions, yet js/background.js:63 and js/weather.js:49 make cross-origin fetches. A service worker pulling a remote wallpaper normally needs host permissions for that. Either the manifest read missed the key, or those fetches point at packaged resources. Pulling the literal URL arguments from those two lines and the host_permissions key from manifest.json would settle it. That gap earns one more pass; it is not grounds for calling the extension harmful, because no finding names a destination outside the extension's own feature set, and the categories that would show exfiltration, secrets or obfuscation, are empty.

Key Reasons

• Zero malware and zero malware-signature matches across 300 findings; the 45 code-smell findings are low severity with no malware family
• Recorded endpoints are extractor artifacts ('4z.bo', '9y.ba', 'du6.br', '2jދn.nr' with a Thaana letter, '9ʔ.sg' with a glottal stop), not resolvable services
• NET-FETCH findings at js/background.js:63-96, js/sidePanel.js:362 and js/weather.js:49 match the stated live wallpaper and weather features
• No obfuscation, secret, dependency or tool-poisoning findings; the developer domain gameograf.com is attributed and the name matches the description
• The developer's own domain is absent from the endpoint list, showing the extractor did not capture actual traffic

False Positive Considerations

• 249 XIOC entries are short suffix-shaped fragments and property-access substrings, several containing non-Latin characters
• 45 code-smell rules firing on ordinary extension JavaScript at low severity
• Fetch detections in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js are expected behavior for video wallpaper and weather features
• No manifest permissions captured, so capability findings that would normally appear are missing entirely

Reviewed 2026-10-27; recommended action: suppress false positive; model confidence 78%.