Open-source atomic malware analysis

Analyze another

peter-evans/create-pull-request v4

UNKNOWN
Verdict: BENIGN
SHA256: 4e3f77dc22f4a23a32a783f5426f3ae19d8a1157983484820ccebc7ef10ca87c
“A GitHub action to create a pull request for changes to your repository in the actions workspace”
Mal-ecule
K(Li₂)O(As)H₅(Cm₁₇Db₁₁F₈Os₆Po₉)Md₅(Bk₄LiPa₆)
Size 1.3 MB download unavailable
First seen 3 days ago
Analyzed 2 hours ago
Package pkg:github/peter-evans/create-pull-request@v4
Ecosystem github
Source codeload.github.com

Referenced by 8 samples

Well-known

notable severity, 99% confident.
lib/format iconv-lite DBCS decoding-table implementation
notable severity, 99% confident.
lib/web whatwg-url basicURLParse API marker

Objectives

notable severity, 96% confident.
anti-static/obfuscation/string Over 1000 JavaScript Unicode escapes

Micro-behaviors

notable severity, 94% confident.
communications/proxy Target host is loopback or wildcard IPv4
notable severity, 100% confident.
communications/socket JavaScript outbound socket connection
notable severity, 95% confident.
data/decode Inline alphabet-table index lookup
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 93% confident.
data/source/property Runs a high-iteration JavaScript loop
notable severity, 95% confident.
fs/directory Shell changes working directory
notable severity, 96% confident.
os/env/vars Actions OIDC token request env vars
notable severity, 94% confident.
process/create/shell GitHub Actions creates and pushes a tag
notable severity, 94% confident.
process/create/vcs JavaScript Git repository query command
notable severity, 95% confident.
process/interpreter Access to process.binding

Metadata

notable severity, 98% confident.
build Code bundled with the ncc webpack runtime
notable severity, 95% confident.
library Preserves original JavaScript console methods
notable severity, 96% confident.
package/quality Node proxy-agent CONNECT TLS upgrade client
notable severity, 95% confident.
package/testing Jest test framework

20 of 66 traits shown

Identity

SHA-256 4e3f77dc22f4a23a32a783f5426f3ae19d8a1157983484820ccebc7ef10ca87c
Filename v4
Package peter-evans/create-pull-request
Version v4
PURL pkg:github/peter-evans/create-pull-request@v4

Origin

Source upload
Ecosystem github
Domain github.com
URL https://codeload.github.com/peter-evans/create-pull-request/tar.gz/v4

Timeline

First seen 11 Aug 2026 18:17 UTC
First analyzed 11 Aug 2026 18:23 UTC
Last analyzed 15 Aug 2026 08:13 UTC
Last updated 15 Aug 2026 08:15 UTC

Labeling

Label unknown
Label source upload
Traits version 59a44