Punpun Onodera Anime Kids Shooting Star Night Live Wallpaper

AI Security Review

Evidence context: threat category browser hijack; evidence quality strong.

This extension presents significant browser hijacking risk through extensive monetization infrastructure. The evidence bundle reveals 671 IoC findings, all categorized as suspicious domain references including 0.ml, bk.si, my.ne, 0jez.mq, a.re, d.kr, t5.ps, q.nc, u.cc, r.no, ʯhd.pm, and r-n.nf. These domains are not legitimate content delivery infrastructure—they are short, monetization-style domains commonly associated with URL shorteners, ad networks, and traffic redirection schemes. A legitimate anime wallpaper extension would require at most a handful of domains for hosting images or videos, not hundreds of monetization endpoints.

The extension's functionality directly aligns with browser hijacking patterns: it modifies the Chrome new tab page, which is a primary vector for ad injection and search engine hijacking. The description states this is a "live wallpaper for your Chrome new tab," confirming it replaces the default new tab experience. When combined with the 671 monetization domains, this indicates the extension serves as a vehicle for displaying ads or redirecting user traffic rather than providing the promised anime wallpaper content.

The developer identity compounds the risk: [email protected] is a generic Gmail address with no company attribution or verification. Anonymous publishers combined with high-volume monetization domains is a known red flag profile for browser hijackers and PUPs. The extension has only 14 users, suggesting it has not been widely vetted by the community.

Counterargument: A skeptic might argue that the 671 IoC findings could be false positives from bundled dependencies or that these domains serve legitimate content delivery purposes for the wallpaper. This is incorrect because: (1) the domains are not CDN infrastructure like googleapis.com or gstatic.com, they are short monetization domains; (2) the findings_summary shows 0 dependency findings, meaning these are not from bundled npm packages; (3) no legitimate wallpaper extension requires hundreds of redirect domains. The nature of these domains, not their count, drives the verdict.

Recommendation: Users should avoid installing this extension. It exhibits classic browser hijacking behavior with monetization abuse rather than delivering the promised anime wallpaper functionality.

Key Reasons

• 671 monetization-style domains (0.ml, bk.si, a.re, u.cc) indicate ad network integration
• New tab page replacement is a known browser hijacking vector
• Anonymous developer (Gmail address) with no company attribution
• Domain count far exceeds legitimate wallpaper extension needs
• No malware signatures but behavior matches PUP/browser hijack patterns

False Positive Considerations

• None identified - IoC domains are specific monetization endpoints, not generic infrastructure

Reviewed 2026-04-28; recommended action: escalate; model confidence 82%.