Hiyuki Guardian of Crimson Snow (WuWa) Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension presents a classic case of automated scanning noise overwhelming actual security signals. The 154 reported findings are almost entirely false positives generated by the XIOC extractor misreading JavaScript property access chains as domain names. Specific examples include b.find.id, b.filter.id, oe.flat.call, c.postdispatch.call, f.remove.call, f.add.call, and l.opts.start.call — these are clearly JavaScript method calls (like object.property.method()) that the extractor incorrectly parsed as domain strings.

The evidence shows zero malware signatures (malware-signature: 0), zero malware findings (malware: 0), zero obfuscation detections (obfuscation: 0), and zero code-smell findings (code-smell: 0). This is a critical pattern: real malicious extensions typically trigger at least some malware signature matches or obfuscation detections. The absence of these findings strongly indicates benign code.

The only potentially legitimate domain in the IoC list is ovkas.com, which appears once. Without additional context about this domain's purpose or reputation, it cannot be classified as malicious on its own. The other domains like jquery.org are legitimate CDN/library domains, while d.fr, ce.support, and i.support are generic domains that could be benign configuration values.

The extension's description — "Transform your new tab with stunning live HD wallpapers featuring Hiyuki, the Guardian of Crimson Snow" — is consistent with a legitimate cosmetic customization tool. The developer uses a personal Gmail address ([email protected]), which is common for hobbyist developers but does not indicate malice. The zero user count suggests this is either newly published or has not gained traction, but user count alone is neither a safety signal nor a danger signal.

Counterargument: A skeptic might point to the 4 high-severity findings and the unknown domain ovkas.com as potential threats. However, severity ratings in this system are inflated by finding volume and IoC counts, not by actual malicious behavior. The high-severity labels apply to the same property-access-chain false positives. Without malware signatures, obfuscation, or evidence of credential theft, browser hijacking, or data exfiltration, there is no substantive threat to act upon. The extension's stated purpose (wallpaper customization) matches its behavior profile, and no findings indicate it does anything beyond displaying images.

Recommended action: Suppress the false positive findings and monitor for future updates. If the extension gains users or receives reports, reanalysis would be warranted.

Key Reasons

• All 154 IoC findings are XIOC false positives from property access chains (b.find.id, f.remove.call, etc.)
• Zero malware signatures detected
• Zero obfuscation findings
• Zero code-smell findings
• Extension purpose (wallpaper customization) matches description with no behavioral mismatch

False Positive Considerations

• XIOC property access chain misinterpretation
• IoC count inflation without malicious domains
• Severity scoring based on finding volume not nature

Reviewed 2026-06-02; recommended action: suppress false positive; model confidence 82%.