Summary
Togoder Security scanned the npm package @actions/exec@3.0.0 on Oct 6, 2026. An AI review of 3 source files produced 2 medium severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Command Execution
NPS-5C1C102612BB
The module exports functions exec and getExecOutput that execute arbitrary system commands via ToolRunner. The commandLine parameter is parsed and the first argument is used as the executable path, allowing callers to run any binary with any arguments. While this is expected for a process execution library (like @actions/exec), it represents a powerful capability that could be abused if the package is compromised or if untrusted input is passed.
Lack of Input Validation
NPS-B0E80DA298C3
The commandLine parameter is split into arguments without validation or sanitization. Although the documentation states arguments must be correctly escaped, the library itself does not enforce any restrictions, potentially leading to command injection if untrusted input is supplied by consumers.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/exec.js | medium | The code is a legitimate command execution wrapper (similar to @actions/exec) but exposes process spawning functionality that could be risky if misused or if the package is compromised. |
| lib/interfaces.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/toolrunner.js | safe | This is the legitimate GitHub Actions toolrunner library; no malicious patterns detected. |
Frequently asked questions
Is @actions/exec safe to use?
No confirmed malware was found in @actions/exec@3.0.0, but the review flagged 2 medium severity findings for risky patterns worth checking before you rely on it.
Does @actions/exec contain malware?
No malware was identified in @actions/exec@3.0.0 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @actions/exec checked?
Togoder Security downloaded the published npm package and had an AI model read its 3 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @actions/exec together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @actions/exec@3.0.0, cost nothing.