---
title: "GHSA-mh23-rw7f-v5pq: `time-sync` was removed from crates.io due to malicious code"
url: https://erroneo.us/security/ghsa/GHSA-mh23-rw7f-v5pq/
description: "GHSA-mh23-rw7f-v5pq (critical, crates.io (Rust)): time-sync was removed from crates.io due to malicious code. The time-sync crate attempted to exfiltrate…"
type: advisory
section: "Security Digest"
date_published: 2026-03-05
date_modified: 2026-03-05
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-mh23-rw7f-v5pq"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-mh23-rw7f-v5pq: `time-sync` was removed from crates.io due to malicious code

## Affected packages

- crates.io (Rust) `time-sync` >= 0 → fixed: none listed

## Details

The time-sync crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service. This the same attack that we've seen three times in the last few days. The malicious crate had 1 version published on 2026-03-04 approximately 50 minutes before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.

## Sources

- [GitHub Advisory GHSA-mh23-rw7f-v5pq](https://github.com/advisories/GHSA-mh23-rw7f-v5pq)
- [rustsec.org](https://rustsec.org/advisories/RUSTSEC-2026-0036.html)

---
Source page: https://erroneo.us/security/ghsa/GHSA-mh23-rw7f-v5pq/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt