GHSA-mh23-rw7f-v5pq `time-sync` was removed from crates.io due to malicious code
A malicious Rust crate exfiltrated environment files to an attacker-controlled server, requiring developers to avoid using the removed package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-mh23-rw7f-v5pq?
GHSA-mh23-rw7f-v5pq is a vulnerability in time-sync, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The time-sync crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service. This the same attack that we've seen three times in the last few days.
The malicious crate had 1 version published on 2026-03-04 approximately 50 minutes before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.
Which versions are affected by GHSA-mh23-rw7f-v5pq?
3 open source packages ship an affected version, including time-sync.
| Package | Affected | Fixed in |
|---|---|---|
time-sync crates.io | All versions | None |
time-sync crates.io | All versions | None |
time-sync crates.io | From 0.0.0-0 | None |
How do I fix GHSA-mh23-rw7f-v5pq?
No fix has been published for GHSA-mh23-rw7f-v5pq yet. Limit exposure of the affected software until one is available.
Is GHSA-mh23-rw7f-v5pq being exploited?
There is no known exploitation of GHSA-mh23-rw7f-v5pq in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0036.