Open-source atomic malware analysis

Analyze another

actions/upload-artifact 3cea5372237819ed00197afe530f5a7ea3e805c8

UNKNOWN
Verdict: BENIGN
SHA256: 1d10cef477201e883e705cfb2d65b02362bef05b63c16bf8bdfe93c16c3aaeda
Mal-ecule
H₆(Cm₉CrDb₇F₅Os₃Po₂)Md₄(BkInPa₅)
Size 225.7 KB download
First seen 14 days ago
Analyzed 14 days ago
Package pkg:github/actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
Ecosystem github
Source codeload.github.com

Referenced by 6 samples

Micro-behaviors

notable severity, 90% confident.
communications/http JavaScript Basic Authorization header
notable severity, 84% confident.
communications/http/download Structured file has curl/wget output path
notable severity, 82% confident.
communications/http/url Mutates a URL query parameter collection
notable severity, 90% confident.
communications/socket Node TLS check disabled by option
notable severity, 86% confident.
crypto/hash MD5 or SHA digest API call
notable severity, 92% confident.
data/control-flow CommonJS module re-exports required package
notable severity, 94% confident.
data/encode JavaScript comment contains Base64-like content
notable severity, 85% confident.
data/source/syntax Variable receives a function expression
notable severity, 85% confident.
fs/chmod Node calls chmod to change permissions
notable severity, 84% confident.
fs/enumerate Calls Node.js synchronous directory enumeration
notable severity, 90% confident.
fs/file/write Node asynchronously writes a file
notable severity, 85% confident.
os/env/vars GITHUB_PATH environment file
notable severity, 90% confident.
os/network Reference to a UNC network share path

Metadata

notable severity, 95% confident.
build Action input references workflow secret
notable severity, 90% confident.
file Several Base64-looking strings in source
notable severity, 95% confident.
package/files JavaScript package file under the dist tree
notable severity, 90% confident.
package/manifest Repository identifies major Git host
notable severity, 90% confident.
package/quality Package declares TypeScript tooling
notable severity, 95% confident.
package/testing Jest test framework

20 of 44 traits shown

Identity

SHA-256 1d10cef477201e883e705cfb2d65b02362bef05b63c16bf8bdfe93c16c3aaeda
Filename 3cea5372237819ed00197afe530f5a7ea3e805c8
Package actions/upload-artifact
Version 3cea5372237819ed00197afe530f5a7ea3e805c8
PURL pkg:github/actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8

Origin

Source upload
Ecosystem github
Domain github.com
URL https://codeload.github.com/actions/upload-artifact/tar.gz/3cea5372237819ed00197afe530f5a7ea3e805c8

Timeline

First seen 12 Aug 2026 00:19 UTC
First analyzed 12 Aug 2026 00:38 UTC
Last analyzed 12 Aug 2026 18:12 UTC
Last updated 12 Aug 2026 18:11 UTC

Labeling

Label unknown
Label source upload
Traits version 73866