Jujutsu Kaisen Gojo Sukuna Cursed Power Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Jujutsu Kaisen Gojo Sukuna Cursed Power Live Wallpaper is a Chrome new tab replacement, version 1.1.6, published under the name [email protected]. Its manifest declares no permissions and no host permissions. The scan returned 140 results: 121 in the IoC bucket and 19 in code-smell. Malware signatures, obfuscation, network, dependency, secret and tool-poisoning categories are all empty.

The IoC contents explain themselves. Every entry is a one to four character label sitting on a two-letter country TLD: XIOC-DOMAIN-g.ng, XIOC-DOMAIN-q.zw, XIOC-DOMAIN-8u.ug, XIOC-DOMAIN-f.gh, XIOC-DOMAIN-m.yt, XIOC-DOMAIN-l.sc. The extracted endpoint list repeats the same strings (4-.bt, h2.bg, bql.mz, cl9k.az, csr.pg). That is the shape a domain regex produces when it runs over minified JavaScript, where variable chains and property lookups get sliced into hostname-shaped tokens. Three entries settle it. XIOC-DOMAIN-ڑ.bs and XIOC-DOMAIN-ޘ.vg carry Arabic and Thaana characters in the label, and XIOC-DOMAIN-î.my carries a Latin accent. None of those are registrable domains. They are raw string bytes from the bundle.

Nothing in the endpoint list resembles a service a wallpaper extension would call. There is no image CDN, no ad feed, no search domain, no query template and no redirector. The single recognizable name, jquery.org, is a JavaScript library reference. A new tab page that fetched remote wallpapers or rewrote the address bar would need a matching host permission in the manifest, and the manifest has none.

The 19 code-smell results are low-severity rules of the kind that match any bundled JavaScript: generic patterns around environment variables, API keys and standard library calls. They describe code shape, not intent, and they carry no weight against the IoC picture.

A skeptic would point at the publisher and the category. The developer is an unverified Gmail address, the install count is zero, and live wallpaper extensions from unknown publishers have a history of injecting ads into the new tab page. All of that is true and none of it is evidence in this dataset. The extractor an extension cannot prove a negative using an extractor that turns a two-letter variable into a Bhutanese domain, but the specific signals that would confirm new tab monetization are absent: no search provider override in the manifest, no host permission, no network finding, no obfuscation. If a later version adds a host permission, a chrome_url_overrides entry pointing off-extension, or a search provider, that changes the picture and this warrants a fresh scan.

One separate note that is not a security matter: the name uses licensed anime characters, which is a trademark question for the rights holder, not a risk to anyone's browser.

Key Reasons

• All 121 IoC entries are short-label plus country-TLD fragments (XIOC-DOMAIN-g.ng, XIOC-DOMAIN-q.zw, XIOC-DOMAIN-8u.ug) consistent with a domain regex run over minified JavaScript.
• Some IoC labels contain non-Latin or accented characters (XIOC-DOMAIN-ڑ.bs, XIOC-DOMAIN-ޘ.vg, XIOC-DOMAIN-î.my), which cannot be registrable domains.
• Malware-signature, obfuscation, network, dependency, secret, manifest-analysis and tool-poisoning categories are all zero.
• The manifest declares no permissions and no host permissions, so there is no sanctioned path to browsing data as shipped.
• The remaining 19 results are low-severity code-smell rules that match any bundled JavaScript.

False Positive Considerations

• XIOC domain extraction from minified/bundled JavaScript producing short-label plus country-TLD fragments
• Impossible domain labels carrying Arabic, Thaana and accented characters, showing raw string bytes were parsed as hostnames
• Low-severity code-smell YARA rules firing on ordinary bundled JavaScript
• Absence of any malware, obfuscation, network or manifest findings in a 140-result scan

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 75%.