GHSA-mh23-rw7f-v5pq

Source

https://github.com/advisories/GHSA-mh23-rw7f-v5pq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mh23-rw7f-v5pq/GHSA-mh23-rw7f-v5pq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mh23-rw7f-v5pq

Aliases

RUSTSEC-2026-0036

Published

2026-03-05T21:15:45Z

Modified

2026-03-06T06:26:26Z

Summary

`time-sync` was removed from crates.io due to malicious code

Details

The time-sync crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service. This the same attack that we've seen three times in the last few days.

The malicious crate had 1 version published on 2026-03-04 approximately 50 minutes before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-05T21:15:45Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

https://rustsec.org/advisories/RUSTSEC-2026-0036.html

Affected packages

crates.io / time-sync

Package

Name: time-sync; View open source insights on deps.dev
Purl: pkg:cargo/time-sync

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mh23-rw7f-v5pq/GHSA-mh23-rw7f-v5pq.json"