Open-source atomic malware analysis

Analyze another

actions/checkout v3.3.0

UNKNOWN
Verdict: BENIGN
SHA256: ae4cb9964e5d3a349e498f4e552426a1a296188a8d6ca2afe8263fa402cb1f52
“Action for checking out a repo”
Mal-ecule
K(Li)H₆(Cm₂₆Db₁₇F₁₄Os₇Po₁₄Ti)Md₆(Bk₂InLi₂Pa₇)
Size 530.1 KB download
First seen 15 days ago
Analyzed 6 days ago
Package pkg:github/actions/[email protected]
Ecosystem github
Source codeload.github.com

Referenced by 10 samples

Well-known

notable severity, 99% confident.
lib/web whatwg-url basicURLParse API marker

Micro-behaviors

notable severity, 96% confident.
communications/http Access-token field reference
notable severity, 90% confident.
communications/http/download curl output file source
notable severity, 94% confident.
communications/http/request Calls a response JSON parser
notable severity, 96% confident.
communications/http/services GitHub GraphQL API endpoint
notable severity, 92% confident.
data/control-flow JavaScript empty optional-binding catch
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 96% confident.
os/env/vars Actions OIDC token request env vars
notable severity, 92% confident.
process/create JavaScript launches a script interpreter
notable severity, 94% confident.
process/create/shell GitHub Actions creates and pushes a tag
notable severity, 94% confident.
process/create/vcs JavaScript Git repository query command

Metadata

notable severity, 95% confident.
build GitHub Actions Runner.Worker process reference
notable severity, 94% confident.
file Long JavaScript string concatenation chain
notable severity, 99% confident.
file/profile Escaped Unicode script codepoint in source
notable severity, 95% confident.
package/files JavaScript package file under the dist tree

20 of 65 traits shown

Identity

SHA-256 ae4cb9964e5d3a349e498f4e552426a1a296188a8d6ca2afe8263fa402cb1f52
Canonical SHA-256 0e51e846e01d82de8cb069014a4a3f78aee3b2973c4dc8135b346687b16f2083
Filename [email protected]
Package actions/checkout
Version v3.3.0
PURL pkg:github/actions/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem github
Domain github.com
URL https://codeload.github.com/actions/checkout/tar.gz/v3.3.0

Timeline

First seen 11 Aug 2026 16:08 UTC
First analyzed 11 Aug 2026 16:06 UTC
Last analyzed 21 Aug 2026 03:01 UTC
Last updated 21 Aug 2026 03:01 UTC

Labeling

Label unknown
Traits version edf6a