Open-source atomic malware analysis

Analyze another

actions/checkout v7

UNKNOWN
Verdict: BENIGN
SHA256: b3ba491703927b414e6c81b122aad2b45d73a6f291f7d8e4a6b248d6c8135b97
“Action for checking out a repo”
Mal-ecule
K(Li)O(Dy)H₆(Cm₃₈Db₁₉F₁₅Os₈Po₁₆Ti)Md₄(Bk₂LiPa₆)
Size 464.9 KB download
First seen 15 days ago
Analyzed 10 hours ago
Package pkg:github/actions/checkout@v7
Ecosystem github
Source codeload.github.com

Referenced by 10 samples

Well-known

notable severity, 98% confident.
lib/development npm semver Range class module

Micro-behaviors

notable severity, 96% confident.
communications/http Access-token field reference
notable severity, 95% confident.
communications/http/download References a release download URL path
notable severity, 94% confident.
communications/http/request Source parses a bytes HTTP range expression
notable severity, 98% confident.
communications/http/services Imports the GitHub Actions API client
notable severity, 94% confident.
communications/http/url Derives an origin from a URL
notable severity, 92% confident.
data/control-flow JavaScript empty optional-binding catch
notable severity, 92% confident.
data/decode Converts character-code array to string
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 95% confident.
fs/directory Shell changes working directory
notable severity, 100% confident.
fs/file/write Node calls imported writeFileSync
notable severity, 94% confident.
fs/path/sensitive Node builds home SSH directory path
notable severity, 95% confident.
fs/write/file Node fs writes to a file synchronously
notable severity, 96% confident.
os/env/vars Actions OIDC token request env vars
notable severity, 94% confident.
process/create/shell Invokes a Windows shell in command mode
notable severity, 94% confident.
process/create/vcs JavaScript Git repository query command

Metadata

notable severity, 98% confident.
build Code bundled with the ncc webpack runtime
notable severity, 95% confident.
library Preserves original JavaScript console methods
notable severity, 95% confident.
package/files JavaScript file under dist directory
notable severity, 95% confident.
package/testing Jest test framework

20 of 71 traits shown

Identity

SHA-256 b3ba491703927b414e6c81b122aad2b45d73a6f291f7d8e4a6b248d6c8135b97
Canonical SHA-256 34ab1410d32d20ac692ffde3c15ec4c3c9927c100a355b8139227f824c798b0c
Filename checkout@v7
Package actions/checkout
Version v7
PURL pkg:github/actions/checkout@v7

Origin

Source x
Feed pkg.go.dev
Ecosystem github
Domain github.com
URL https://codeload.github.com/actions/checkout/tar.gz/v7

Timeline

First seen 11 Aug 2026 15:31 UTC
First analyzed 11 Aug 2026 15:33 UTC
Last analyzed 26 Aug 2026 20:32 UTC
Last updated 26 Aug 2026 20:33 UTC

Labeling

Label unknown
Traits version 72034