Open-source atomic malware analysis

Analyze another

actions/checkout 08eba0b27e820071cde6df949e0beb9ba4906955

UNKNOWN
Verdict: BENIGN
“Action for checking out a repo”

Referenced by 10 samples

Micro-behaviors

notable severity, 94% confident.
communications/http/request Calls a response JSON parser
notable severity, 96% confident.
communications/http/services GitHub GraphQL API endpoint
notable severity, 94% confident.
communications/http/url Derives an origin from a URL
notable severity, 100% confident.
communications/socket JavaScript outbound socket connection
notable severity, 92% confident.
data/control-flow JavaScript empty named-parameter catch
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 96% confident.
os/env/vars Actions OIDC token request env vars
notable severity, 92% confident.
process/create Requires worker_threads module
notable severity, 94% confident.
process/create/shell GitHub Actions creates and pushes a tag
notable severity, 94% confident.
process/create/vcs JavaScript Git repository query command

Metadata

notable severity, 98% confident.
build Code bundled with the ncc webpack runtime
notable severity, 97% confident.
file Many Base64-like comment spans in JavaScript
notable severity, 95% confident.
library Preserves original JavaScript console methods
notable severity, 95% confident.
package/files JavaScript package file under the dist tree

20 of 74 traits shown

Identity

SHA-256 2c4753304ba4cb83e74743d614008503d2c2fb8ea48467f8264eb653228d004b
Canonical SHA-256 12d4c45e57c1f88153bd387db4ce2b99b812dbce9f09a513f094df4a90181b0b
Filename checkout@08eba0b27e820071cde6df949e0beb9ba4906955
Package actions/checkout
Version 08eba0b27e820071cde6df949e0beb9ba4906955
PURL pkg:github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955

Timeline

First seen 12 Aug 2026 17:49 UTC
First analyzed 12 Aug 2026 17:49 UTC
Last analyzed 21 Aug 2026 07:06 UTC
Last updated 21 Aug 2026 07:07 UTC

Labeling

Label unknown
Traits version 18b13