---
title: "GHSA-77xj-rrh3-wx3v: `time_calibrator` was removed from crates.io due to malicious code"
url: https://erroneo.us/security/ghsa/GHSA-77xj-rrh3-wx3v/
description: "GHSA-77xj-rrh3-wx3v (critical, crates.io (Rust)): timecalibrator was removed from crates.io due to malicious code. It was reported timecalibrator contained…"
type: advisory
section: "Security Digest"
date_published: 2026-03-04
date_modified: 2026-03-04
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-77xj-rrh3-wx3v"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-77xj-rrh3-wx3v: `time_calibrator` was removed from crates.io due to malicious code

## Affected packages

- crates.io (Rust) `time_calibrator` >= 0 → fixed: none listed

## Details

It was reported timecalibrator contained malicious code, that would try to upload .env files to a server. The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user account was locked. There were no crates depending on this crate on crates.io. Rust security response working group thanks Gabriel Silva for finding and reporting this, and thanks to Emily Albini for co-ordinating with the crates.io and infra-admin teams.

## Sources

- [GitHub Advisory GHSA-77xj-rrh3-wx3v](https://github.com/advisories/GHSA-77xj-rrh3-wx3v)
- [rustsec.org](https://rustsec.org/advisories/RUSTSEC-2026-0030.html)

---
Source page: https://erroneo.us/security/ghsa/GHSA-77xj-rrh3-wx3v/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt