RUSTSEC-2026-0031

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0031

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0031.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0031

Aliases

GHSA-wf45-3gpw-vrqv

Published

2026-03-03T12:00:00Z

Modified

2026-03-05T05:53:11Z

Summary

`time_calibrators` was removed from crates.io due to malicious code

Details

The time_calibrators crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service.

The malicious crate had 1 version published on 2026-03-03 approximately 3 hours before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.

Thanks to cybergeek for finding and reporting this to the Rust security response working group, and thanks to Emily Albini for co-ordinating with the crates.io team.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / time_calibrators

Package

Name: time_calibrators; View open source insights on deps.dev
Purl: pkg:cargo/time_calibrators

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "functions": [],
        "os": [],
        "arch": []
    }
}