Security Digest · Critical advisory (no CVE assigned)
GHSA-77xj-rrh3-wx3v: `time_calibrator` was removed from crates.io due to malicious code
It was reported timecalibrator contained malicious code, that would try to upload .env files to a server.
GitHub-reviewed · critical
Should you act?
- Malicious code, not a bug. If any listed version was ever installed, assume the machine and every secret on it are compromised: remove it, rotate credentials, rebuild.
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
cargo audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| crates.io (Rust) | time_calibrator | >= 0 | none listed |
Details
It was reported timecalibrator contained malicious code, that would try to upload .env files to a server.
The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user account was locked. There were no crates depending on this crate on crates.io.
Rust security response working group thanks Gabriel Silva for finding and reporting this, and thanks to Emily Albini for co-ordinating with the crates.io and infra-admin teams.
Sources and references
- GitHub Advisory GHSA-77xj-rrh3-wx3v github.com
- rustsec.org rustsec.org
Critical crates.io (Rust) advisories · Today’s Security Digest