Open-source atomic malware analysis

Analyze another

actions/github-script v3

UNKNOWN
Verdict: BENIGN
SHA256: e1b2b3817ad37e3e695fa76e7ddcc970e15ead421f573a499b2f712e5efe4573
“Write workflows scripting the GitHub API in JavaScript”
Mal-ecule
H₅(Cm₁₈Db₁₅F₅Os₄Po₆)Md₅(Bk₂InLiPa₃)
Size 229.6 KB download
First seen 16 days ago
Analyzed 6 days ago
Package pkg:github/actions/github-script@v3
Ecosystem github
Source codeload.github.com

Referenced by 10 samples

Micro-behaviors

notable severity, 96% confident.
communications/http Access-token field reference
notable severity, 94% confident.
communications/http/request Calls a response JSON parser
notable severity, 90% confident.
communications/http/services GitHub repository contents write endpoint path
notable severity, 90% confident.
communications/http/url URL query is forwarded with append
notable severity, 90% confident.
communications/socket Node TLS check disabled by option
notable severity, 90% confident.
data Creates Node.js Buffer from UTF-8 text
notable severity, 92% confident.
data/control-flow JavaScript empty named-parameter catch
notable severity, 96% confident.
data/decode parseInt parses an octal string
notable severity, 95% confident.
data/encode Encodes Node.js Buffer output as Base64
notable severity, 90% confident.
data/string Chains multiple JavaScript string replacements
notable severity, 90% confident.
fs/file Calls readFileSync
notable severity, 90% confident.
fs/write/file JavaScript file write operation
notable severity, 96% confident.
os/env/vars Actions OIDC token request env vars
notable severity, 90% confident.
os/module CommonJS require inside try fallback
notable severity, 100% confident.
process/create/shell Executes shell commands
notable severity, 95% confident.
process/interpreter JavaScript AsyncFunction compiles code

Metadata

notable severity, 95% confident.
build Code follows a source map directive
notable severity, 94% confident.
file Long JavaScript string concatenation chain
notable severity, 95% confident.
library Preserves original JavaScript console methods
notable severity, 95% confident.
package/files JavaScript package file under the dist tree

20 of 49 traits shown

Identity

SHA-256 e1b2b3817ad37e3e695fa76e7ddcc970e15ead421f573a499b2f712e5efe4573
Canonical SHA-256 14473608a7c98cfd5a7de3c18d0025caafbddd56213567c62d281a3e5f33e2de
Filename v3
Package actions/github-script
Version v3
PURL pkg:github/actions/github-script@v3

Origin

Source upload
Ecosystem github
Domain github.com
URL https://codeload.github.com/actions/github-script/tar.gz/v3

Timeline

First seen 11 Aug 2026 18:16 UTC
First analyzed 11 Aug 2026 18:21 UTC
Last analyzed 21 Aug 2026 05:29 UTC
Last updated 21 Aug 2026 05:30 UTC

Labeling

Label unknown
Label source upload
Traits version 285c0