GHSA-77xj-rrh3-wx3v `time_calibrator` was removed from crates.io due to malicious code
A malicious Rust crate attempted to exfiltrate environment files, requiring developers to avoid using the removed package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-77xj-rrh3-wx3v?
GHSA-77xj-rrh3-wx3v is a vulnerability in time_calibrator, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was reported time_calibrator contained malicious code, that would try to
upload .env files to a server.
The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user account was locked. There were no crates depending on this crate on crates.io.
Thanks to Gabriel Silva for finding and reporting this to the Rust security response working group, and thanks to Emily Albini for co-ordinating with the crates.io and infra-admin teams.
Which versions are affected by GHSA-77xj-rrh3-wx3v?
3 open source packages ship an affected version, including time_calibrator.
| Package | Affected | Fixed in |
|---|---|---|
time_calibrator crates.io | All versions | None |
time_calibrator crates.io | All versions | None |
time_calibrator crates.io | From 0.0.0-0 | None |
How do I fix GHSA-77xj-rrh3-wx3v?
No fix has been published for GHSA-77xj-rrh3-wx3v yet. Limit exposure of the affected software until one is available.
Is GHSA-77xj-rrh3-wx3v being exploited?
There is no known exploitation of GHSA-77xj-rrh3-wx3v in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0030.