False positive from 'D::' in a serde deserializer generic (deser_sampler fn). This is the legitimate rand crate; the flagged code is ordinary UTF-16 surrogate handling for Uniform<char> with no network, exfil, or malicious behavior.
AI breakdown
Plain-English summary of what this package does and how it behaves.
The rand package (v0.10.3) is a Rust crate providing random number generation, including probability distributions and RNG implementations.
Capabilities
- Implements random distributions (Bernoulli, Uniform, Weighted, etc.)
- Provides RNG traits and implementations (StdRng, ThreadRng, SmallRng)
- Includes prelude and utility modules for RNG usage
Data access
- None observed
Network
- Hardcoded public IP in network code (static finding ATK-028)
Standard randomness library with no scripts or dependencies; static analysis flags potential network code that is not evidenced in the provided source sample.
Security findings (2)
Static analysis rule matches, with the exact code that triggered them.
File src/distr/uniform_other.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
File rand-0.10.3/src/distr/uniform_other.rs contains a hardcoded public IP (D::) used in network code — review for hidden exfiltration or C2 endpoints.
Files in package (76)
How ShadowCanopy checks crates.io packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/crates/rand