GHSA-77xj-rrh3-wx3v: `time_calibrator` was removed from crates.io due to malicious code
It was reported timecalibrator contained malicious code, that would try to upload .env files to a server. The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user account was locked. There were no crates depending on this crate on crates.io.
Published Mar 4, 2026
Affected packages
time_calibrator
- Ecosystem
- Rust (crates.io)
- Affected
- >= 0
- Fixed in
- No patched version yet
- Check
cargo tree -i time_calibrator
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
It was reported time_calibrator contained malicious code, that would try to upload .env files to a server.
The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user account was locked. There were no crates depending on this crate on crates.io.
Rust security response working group thanks Gabriel Silva for finding and reporting this, and thanks to Emily Albini for co-ordinating with the crates.io and infra-admin teams.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology