“Action for checking out a repo”
Local reference
Suspicious dependency
Inferred
Referenced by 10 samples
- benign nobg_image_blocker-0.1.1.xpi fetched
- suspicious affiliate_offers_analyzer-1.15.0.xpi fetched
- benign 390cbe447412ced1303d35abe75287949e43437a fetched
- benign seiasinger_fork-1.0.0.xpi fetched
- benign eehdmpacbpooioffaomidhakfidpoheg.crx fetched
- benign seiasinger_fork-1.0.1.xpi fetched
- benign tab_collections_manager-0.1.1.xpi fetched
- hostile github.com-jpillora-meads-v0.38.1.zip fetched
- hostile github.com-salesforcecommercecloud-pwa-kit-v3.14.0-nightly-20251013080213+incompatible.zip fetched
- benign github.com-Proof-of-Ineffective-Input-Lex-v0.1.1.zip fetched
Micro-behaviors
notable severity, 94% confident.
communications/http/request
Calls a response JSON parser
notable severity, 96% confident.
communications/http/services
GitHub GraphQL API endpoint
notable severity, 94% confident.
communications/http/url
Derives an origin from a URL
notable severity, 100% confident.
communications/socket
JavaScript outbound socket connection
notable severity, 92% confident.
data/control-flow
JavaScript empty named-parameter catch
notable severity, 95% confident.
data/encode
Encodes Node.js Buffer output as Base64
notable severity, 96% confident.
os/env/vars
Actions OIDC token request env vars
notable severity, 92% confident.
process/create
Requires worker_threads module
notable severity, 94% confident.
process/create/shell
GitHub Actions creates and pushes a tag
notable severity, 94% confident.
process/create/vcs
JavaScript Git repository query command
Metadata
notable severity, 98% confident.
build
Code bundled with the ncc webpack runtime
notable severity, 97% confident.
file
Many Base64-like comment spans in JavaScript
notable severity, 95% confident.
library
Preserves original JavaScript console methods
notable severity, 95% confident.
package/files
JavaScript package file under the dist tree
20 of 74 traits shown
Identity
| SHA-256 | 2c4753304ba4cb83e74743d614008503d2c2fb8ea48467f8264eb653228d004b |
|---|---|
| Canonical SHA-256 | 12d4c45e57c1f88153bd387db4ce2b99b812dbce9f09a513f094df4a90181b0b |
| Filename | checkout@08eba0b27e820071cde6df949e0beb9ba4906955 |
| Package | actions/checkout |
| Version | 08eba0b27e820071cde6df949e0beb9ba4906955 |
| PURL | pkg:github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 |
Origin
| Source | x |
|---|---|
| Feed | pkg.go.dev |
| Ecosystem | github |
| Domain | github.com |
| URL | https://codeload.github.com/actions/checkout/tar.gz/08eba0b27e820071cde6df949e0beb9ba4906955 |
Timeline
| First seen | 12 Aug 2026 17:49 UTC |
|---|---|
| First analyzed | 12 Aug 2026 17:49 UTC |
| Last analyzed | 21 Aug 2026 07:06 UTC |
| Last updated | 21 Aug 2026 07:07 UTC |
Labeling
| Label | unknown |
|---|---|
| Traits version | 18b13 |
Not seeing what you expected? Let us know