Open-source atomic malware analysis

Analyze another

actions/github-script d7906e4ad0b1822421a7e6a35d5ca353c962f410

UNKNOWN
Verdict: BENIGN
SHA256: a3b209f986d285a3be20f725165c03fa1d474ffbb42b3719d669c2d342908653
“Write workflows scripting the GitHub API in JavaScript”
Mal-ecule
K(Li)H₇(Cm₁₆Cr₂Db₁₄F₃Os₃Po₁₁Ti)Md₅(Bk₃InLiPa₄)
Size 296.5 KB download
First seen 15 days ago
Analyzed 5 days ago
Package pkg:github/actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
Ecosystem github
Source codeload.github.com

Referenced by 10 samples

Well-known

notable severity, 99% confident.
lib/web whatwg-url basicURLParse API marker

Micro-behaviors

notable severity, 96% confident.
communications/http Access-token field reference
notable severity, 95% confident.
communications/http/request Imports the node-fetch HTTP client
notable severity, 96% confident.
communications/http/services GitHub GraphQL API endpoint
notable severity, 90% confident.
communications/http/url URL query is forwarded with append
notable severity, 90% confident.
communications/socket Node TLS check disabled by option
notable severity, 90% confident.
data Creates Node.js Buffer from UTF-8 text
notable severity, 92% confident.
data/control-flow JavaScript empty named-parameter catch
notable severity, 100% confident.
data/db ioredis driver reference
notable severity, 90% confident.
data/decode Calls JavaScript unescape
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 90% confident.
data/string Chains multiple JavaScript string replacements
notable severity, 90% confident.
fs/file Calls readFileSync
notable severity, 96% confident.
os/env/vars Actions OIDC token request env vars
notable severity, 95% confident.
process/interpreter JavaScript AsyncFunction compiles code

Metadata

notable severity, 98% confident.
build Code bundled with the ncc webpack runtime
notable severity, 94% confident.
file Long JavaScript string concatenation chain
notable severity, 99% confident.
file/profile Escaped Unicode script codepoint in source
notable severity, 95% confident.
library Preserves original JavaScript console methods
notable severity, 95% confident.
package/files JavaScript package file under the dist tree

20 of 54 traits shown

Identity

SHA-256 a3b209f986d285a3be20f725165c03fa1d474ffbb42b3719d669c2d342908653
Canonical SHA-256 01fcf20abcc7be831a9577e943d104ac73f240626a02e6a1cba5fd969f3b71c6
Filename github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
Package actions/github-script
Version d7906e4ad0b1822421a7e6a35d5ca353c962f410
PURL pkg:github/actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410

Origin

Source x
Feed pkg.go.dev
Ecosystem github
Domain github.com
URL https://codeload.github.com/actions/github-script/tar.gz/d7906e4ad0b1822421a7e6a35d5ca353c962f410

Timeline

First seen 11 Aug 2026 16:06 UTC
First analyzed 11 Aug 2026 16:03 UTC
Last analyzed 21 Aug 2026 12:58 UTC
Last updated 21 Aug 2026 12:58 UTC

Labeling

Label unknown
Traits version 40b8c