monica_rand_core 0.10.2
The build ran /tmp/code-helper, a program in a writable location, which the build put there.
100
critical
Confirmed by review and reported. Read the published finding.
Evidence
| Points | Signal | Where | What |
|---|---|---|---|
| 60 | exec_dropped trace · monica_rand_core | /tmp/code-helper | The build ran /tmp/code-helper, a program in a writable location, which the build put there. |
| 40 | static:dropper_pattern static · monica_rand_core | build.rs:83 | high severity dropper_pattern in build_script code: helper/windows (133632 bytes) at build.rs:83 with ShellExecuteW at build.rs:20 |
| 30 | static:environment_enumeration static · monica_rand_core | build.rs:78 | high severity environment_enumeration in build_script code: std::env::vars |
| 15 | environment_dumped disk · monica_rand_core | /work/.warm/upper/debug/build/monica_rand_core-a8753f4b4e599305/output | A build script wrote the whole environment, with the planted github_token_env, into its build directory. |
| 10 | new_high_finding diff · monica_rand_core | build.rs:78 | New since 0.10.1: environment_enumeration |
| 5 | new_behavior diff · monica_rand_core | dump:environment | New since the previous version: dump:environment. |
8 without points
| Signal | Where | What |
|---|---|---|
| static:build_script static · monica_rand_core | build.rs | low severity build_script in build_script code: build.rs |
| static:foreign_functions static · monica_rand_core | build.rs:18 | medium severity foreign_functions in build_script code (2 places): extern block |
| static:included_binary static · monica_rand_core | build.rs:83 | high severity included_binary in build_script code (3 places): helper/windows (133632 bytes) |
| static:process_spawn static · monica_rand_core | build.rs:59 | medium severity process_spawn in build_script code: std::process::Command::new |
| static:windows_api static · monica_rand_core | build.rs:20 | high severity windows_api in build_script code (2 places): ShellExecuteW |
| static:yara:embedded_elf_executable static · monica_rand_core | helper/linux | medium severity yara:embedded_elf_executable in library code: An ELF executable or library shipped inside the crate |
| static:yara:embedded_macho_executable static · monica_rand_core | helper/darwin | medium severity yara:embedded_macho_executable in library code: A Mach-O executable shipped inside the crate |
| static:yara:embedded_pe_executable static · monica_rand_core | helper/windows | medium severity yara:embedded_pe_executable in library code: A Windows executable shipped inside the crate |
Behavior
New since the previous version
dump:environment static:environment_enumeration
Profile
dump:environment exec:dropped static:dropper_pattern static:environment_enumeration static:foreign_functions static:included_binary static:process_spawn static:windows_api static:yara:embedded_elf_executable static:yara:embedded_macho_executable static:yara:embedded_pe_executable
Static findings
11 groups
high included_binary build_script 3
helper/windows (133632 bytes)build.rs:83helper/darwin (471360 bytes)build.rs:85helper/linux (511872 bytes)build.rs:87
high windows_api build_script 2
ShellExecuteWbuild.rs:20 build.rs:34
high dropper_pattern build_script 1
helper/windows (133632 bytes) at build.rs:83 with ShellExecuteW at build.rs:20build.rs:83
high environment_enumeration build_script 1
std::env::varsbuild.rs:78
medium foreign_functions build_script 2
extern blockbuild.rs:18 build.rs:65
medium process_spawn build_script 1
std::process::Command::newbuild.rs:59
medium yara_match embedded_elf_executable library 1
An ELF executable or library shipped inside the cratehelper/linux
medium yara_match embedded_macho_executable library 1
A Mach-O executable shipped inside the cratehelper/darwin
medium yara_match embedded_pe_executable library 1
A Windows executable shipped inside the cratehelper/windows
low build_script build_script 1
build.rsbuild.rs
info unsafe_code build_script 1
2 unsafe blocks, functions or implsbuild.rs:33
Run: full
succeededThe full build covers everything the earlier cargo check run did, so only the full run is shown.
- Honeytoken github_token_env was copied into /work/.warm/upper/debug/build/monica_rand_core-a8753f4b4e599305/output
- Ended
- agent reported the end
- Guest
- exit code 0
- Run time
- 915 ms
- VM restore
- 123 ms
- Payload
- 26 files, 1.1 MiB
- Files opened
- 363
Processes 9
Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.
| Process | Arguments | Start | Took | Exit |
|---|---|---|---|---|
| cargo /usr/local/bin/cargo | build --locked --offline | 10 ms | 893 ms | 0 |
| └rustc /usr/local/bin/rustc | --crate-name build_script_build --edition=2024 /cw/vendor/monica_rand_core-0.10.2/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --warn=clippy::undocumented_unsafe_blocks --warn=missing_docs --warn=missing_debug_implementations --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=7606194b37ca7aab -C extra-filename=-a6801c48877bef73 --out-dir /work/target/debug/build/monica_rand_core-a6801c48877bef73 -L dependency=/work/target/debug/deps --cap-lints allow | 123 ms | 663 ms | 0 |
| └toolchain /usr/bin/cc | -m64 /work/target/debug/build/monica_rand_core-a6801c48877bef73/rustcGfAkd2/symbols.o /work/target/debug/build/monica_rand_core-a6801c48877bef73/build_script_build-a6801c48877bef73.build_script_build.5c208d34004f2719-cgu.0.rcgu.o /work/target/debug/build/monica_rand_core-a6801c48877bef73/build_script_build-a6801c48877bef73.2o52dew8h4m2ti23nk952rtks.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-li | 629 ms | 154 ms | 0 |
| └toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 | -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccdMSipK.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/monica_rand_core-a6801c48877bef73/build_script_build-a6801c48877bef73 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/monica_rand_core-a6801c48877bef73/rustcGfAkd2/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-li | 636 ms | 147 ms | 0 |
| └toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld | -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccdMSipK.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/monica_rand_core-a6801c48877bef73/build_script_build-a6801c48877bef73 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/monica_rand_core-a6801c48877bef73/rustcGfAkd2/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr | 639 ms | 142 ms | 0 |
| └build_script monica_rand_core | 789 ms | 2 ms | 0 | |
| └other /tmp/code-helper | 791 ms | 1 ms | 25856 | |
| └rustc /usr/local/bin/rustc ×2 | --crate-name rand_core --edition=2024 /cw/vendor/monica_rand_core-0.10.2/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --warn=clippy::undocumented_unsafe_blocks --warn=missing_docs --warn=missing_debug_implementations --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=b3b0ef1f468354e6 -C extra-filename=-218fbdf73fa828e7 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow | 793 ms | 83 ms | 0 |
Network 0
No network activity.
Files 0
Secrets opened
None.
Written outside the build directories
None.
Scratch disk 0
- Files
- 46
- Directories
- 26
- Size
- 10.1 MiB
- Compiled units
- 4
Nothing outside the build areas.
Output
Standard error
Compiling monica_rand_core v0.10.2
Compiling crateward-probe v0.0.0 (/cw/probe)
Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.85s
Timeline
9
| When | From | To | Event | Worker |
|---|---|---|---|---|
| 2026-09-29 05:46 UTC | Discovered | Fetched | fetched | fetcher-627152 |
| 2026-09-29 05:46 UTC | Fetched | ReadyForSandbox | static_analysis_completed | static-450252 |
| 2026-09-29 05:46 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-639812-slot1 |
| 2026-09-29 05:46 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-639812-slot1 |
| 2026-09-29 05:46 UTC | DynamicallyAnalyzed | ReadyForSandbox | scored | analyzer-523934 |
| 2026-09-29 05:46 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-639812-slot0 |
| 2026-09-29 05:46 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-639812-slot0 |
| 2026-09-29 05:46 UTC | DynamicallyAnalyzed | Scored | scored | analyzer-523934 |
| 2026-09-29 05:46 UTC | Scored | Done | finalized | analyzer-523934 |