GHSA-wf45-3gpw-vrqv `time_calibrators` was removed from crates.io due to malicious code
A malicious Rust crate exfiltrated environment files to an attacker-controlled server, posing a supply chain risk to developers who might have installed it.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-wf45-3gpw-vrqv?
GHSA-wf45-3gpw-vrqv is a vulnerability in time_calibrators, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The time_calibrators crate attempted to exfiltrate .env files to a server
that was in turn impersonating the legitimate timeapi.io service.
The malicious crate had 1 version published on 2026-03-03 approximately 3 hours before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.
Thanks to cybergeek for finding and reporting this to the Rust security response working group, and thanks to Emily Albini for co-ordinating with the crates.io team.
Which versions are affected by GHSA-wf45-3gpw-vrqv?
3 open source packages ship an affected version, including time_calibrators.
| Package | Affected | Fixed in |
|---|---|---|
time_calibrators crates.io | All versions | None |
time_calibrators crates.io | All versions | None |
time_calibrators crates.io | From 0.0.0-0 | None |
How do I fix GHSA-wf45-3gpw-vrqv?
No fix has been published for GHSA-wf45-3gpw-vrqv yet. Limit exposure of the affected software until one is available.
Is GHSA-wf45-3gpw-vrqv being exploited?
There is no known exploitation of GHSA-wf45-3gpw-vrqv in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0031.