Open-source atomic malware analysis

Analyze another

actions/checkout v4.1.5

UNKNOWN
Verdict: BENIGN
SHA256: 7aac1749fc3f3c1048caf2cb2c2a3d0b8f9005e0a975ced1e2c8da5b3ff42068
“Action for checking out a repo”
Mal-ecule
K(Am)O₄(C₂CaDy₂S)H₈(Cm₃₃CrDb₁₆F₁₁Os₅Po₁₁Ti)Md₆(Bk₂InLiPa₇Pt)
Size 413.8 KB download
First seen 15 days ago
Analyzed 14 days ago
Package pkg:github/actions/[email protected]
Ecosystem github
Source codeload.github.com

Referenced by 6 samples

Well-known

notable severity, 98% confident.
app/development GitLab release creation method

Objectives

notable severity, 94% confident.
command-and-control/dropper/execution HTML carries PowerShell archive command
notable severity, 94% confident.
credential-access/ssh Node enumerates a user's .ssh directory
notable severity, 96% confident.
supply-chain/credential-theft GitHub Actions OIDC environment variables

Micro-behaviors

notable severity, 94% confident.
browser-extension Derives an origin from a browser URL
notable severity, 95% confident.
communications/http HTTP request enables same-origin credentials
notable severity, 94% confident.
communications/http/request Calls a response JSON parser
notable severity, 94% confident.
communications/proxy Target host is IPv6 loopback
notable severity, 100% confident.
communications/socket JavaScript outbound socket connection
notable severity, 92% confident.
data/control-flow CommonJS module re-exports required package
notable severity, 94% confident.
data/decode Copies charCodeAt values into an array
notable severity, 94% confident.
data/encode JavaScript comment contains Base64-like content
notable severity, 94% confident.
process/create/shell GitHub Actions creates and pushes a tag

Metadata

notable severity, 98% confident.
build Code bundled with the ncc webpack runtime
notable severity, 97% confident.
file Many Base64-like comment spans in JavaScript
notable severity, 95% confident.
library Preserves original JavaScript console methods
notable severity, 95% confident.
package/files JavaScript package file under the dist tree

20 of 80 traits shown

Identity

SHA-256 7aac1749fc3f3c1048caf2cb2c2a3d0b8f9005e0a975ced1e2c8da5b3ff42068
Canonical SHA-256 1379e8c691cb3e0e706294b3ab1c15cb3bf8533a95c2c61c82851b3548000a9c
Filename [email protected]
Package actions/checkout
Version v4.1.5
PURL pkg:github/actions/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem github
Domain github.com
URL https://codeload.github.com/actions/checkout/tar.gz/v4.1.5

Timeline

First seen 11 Aug 2026 20:44 UTC
First analyzed 11 Aug 2026 20:46 UTC
Last analyzed 12 Aug 2026 18:12 UTC
Last updated 12 Aug 2026 18:11 UTC

Labeling

Label unknown
Traits version 73866