monica_rand_core

Back to the numbers

Versions 0.10.1, 0.10.2 and 0.10.3 of monica_rand_core copied the metadata of the widely used rand_core crate. Their build scripts wrote a prebuilt program for the build machine's operating system to a temporary directory and started it in the background. Version 0.10.2 also printed every environment variable of the build into the build output. Anyone who built a project depending on one of these versions ran these steps on their machine.

Timeline

Behavior

All of it happens in build.rs, which Cargo runs on the building machine before compiling the crate:

1. Version 0.10.2 only: it prints each environment variable as a Cargo warning (cargo:warning=KEY=VALUE, line 78). For a dependency from crates.io, Cargo does not show these warnings unless asked to (-vv), but it stores them in the build directory, under target/, where build caches and CI artifacts can carry them further. In the microVM, the fake GitHub token Crateward planted in the environment ended up in that stored output.

2. Every version embeds one of three prebuilt executables, chosen by operating system (helper/linux, helper/darwin, helper/windows), and writes it to /tmp/code-helper, or code-helper.exe in the temporary directory on Windows. The three executables are the same in all three versions.

3. On Linux and macOS it makes the file executable and starts it in a new session with its input and output discarded, so it outlives the build. On Windows it starts it hidden through ShellExecuteW. Version 0.10.3 starts it in the directory that holds the build's target/ directory, normally the root of the project being built.

In the microVM the Linux helper started in every version, made no network attempt and exited with status 101. Crateward's VM has no internet, and the helper may behave differently elsewhere. Its purpose was not analyzed further.

Indicators

How Crateward found it

Each version was fetched within three minutes of its publication. The static analysis flagged the three embedded executables and the hidden process start in every version, and in 0.10.2 also the build script reading every environment variable. The builds in the microVM recorded the helper starting from /tmp in every version, and in 0.10.2 the planted token copied into the build output. A full build in a fresh VM confirmed 0.10.2.

Correction: on 2026-10-02 this page said that 0.10.1 did not show this behavior in Crateward's analysis. That was wrong. Crateward's trace of 0.10.1 showed the helper starting, but its scoring at the time weighed the copied token and not a program started from a temporary directory, so 0.10.1 and 0.10.3 were not flagged for review. After the scoring changed on 2026-10-06, re-scoring the stored evidence flagged both as critical, and a human reviewed it.

MITRE ATT&CK techniques the evidence is consistent with: T1082 (system information discovery, 0.10.2), T1552.001 (credentials in files, 0.10.2) and T1027.009 (embedded payloads).

Remediation

If a machine or CI job built a project depending on monica_rand_core 0.10.1, 0.10.2 or 0.10.3:

• Treat the machine as compromised: an unknown program ran on it, and it may still be running. Look for code-helper processes and files.
• Treat every secret on that machine or in that build's environment as exposed: tokens, cloud keys and registry credentials. Rotate them. For 0.10.2, also check verbose build logs, build caches and CI artifacts that include target/ for the printed values.
• Replace the dependency with rand_core from the Rand project.

Crateward keeps the original crate files as they were published, with the checksums crates.io listed for them. Contact: security@janfedler.de. Mistakes are corrected on this page.