Open-source atomic malware analysis

Analyze another

actions/checkout ac593985615ec2ede58e132d2e21d2b1cbd6127c

UNKNOWN
Verdict: BENIGN
SHA256: 662b9eb27a007a00eaed3063561f2dbaf8f6ac162256fc9c85edc0b0f47029a4
“Action for checking out a repo”
Mal-ecule
K(Li)H₆(Cm₂₅Db₁₇F₁₄Os₇Po₁₄Ti)Md₆(Bk₂InLi₂Pa₇)
Size 530.1 KB download
First seen 16 days ago
Analyzed 6 days ago
Package pkg:github/actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
Ecosystem github
Source codeload.github.com

Referenced by 10 samples

Well-known

notable severity, 99% confident.
lib/web whatwg-url basicURLParse API marker

Micro-behaviors

notable severity, 90% confident.
communications/http/download curl output file source
notable severity, 94% confident.
communications/http/request Calls a response JSON parser
notable severity, 98% confident.
communications/http/services Imports the GitHub Actions API client
notable severity, 92% confident.
data/control-flow CommonJS module re-exports required package
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 96% confident.
os/env/vars Actions OIDC token request env vars
notable severity, 92% confident.
process/create JavaScript launches a script interpreter
notable severity, 94% confident.
process/create/shell GitHub Actions creates and pushes a tag
notable severity, 94% confident.
process/create/vcs JavaScript Git repository query command

Metadata

notable severity, 95% confident.
build GitHub Actions Runner.Worker process reference
notable severity, 94% confident.
file Long JavaScript string concatenation chain
notable severity, 99% confident.
file/profile Escaped Unicode script codepoint in source
notable severity, 95% confident.
package/files JavaScript package file under the dist tree

20 of 65 traits shown

Identity

SHA-256 662b9eb27a007a00eaed3063561f2dbaf8f6ac162256fc9c85edc0b0f47029a4
Canonical SHA-256 0e51e846e01d82de8cb069014a4a3f78aee3b2973c4dc8135b346687b16f2083
Filename checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
Package actions/checkout
Version ac593985615ec2ede58e132d2e21d2b1cbd6127c
PURL pkg:github/actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c

Origin

Source x
Feed pkg.go.dev
Ecosystem github
Domain github.com
URL https://codeload.github.com/actions/checkout/tar.gz/ac593985615ec2ede58e132d2e21d2b1cbd6127c

Timeline

First seen 11 Aug 2026 16:08 UTC
First analyzed 11 Aug 2026 16:06 UTC
Last analyzed 22 Aug 2026 06:44 UTC
Last updated 22 Aug 2026 06:45 UTC

Labeling

Label unknown
Traits version 58687