Five malicious Rust crates that pose as time-related tools and send.env file data to threat actors have been found by cybersecurity experts.
The following is a list of Rust packages that have been published to crates.io:
- chrono_anchor
- dnp3times
- time_calibrator
- time_calibrators
- time-sync
According to Socket, the crates were released between late February and early March 2026 and pose as timeapi.io. Based on the usage of the same exfiltration technique and the lookalike domain (“timeapis[.]io”) to store the stolen data, it is determined to be the work of a single threat actor.
According to security researcher Kirill Boychenko, the crates’ primary behavior is credential and secret theft, even if they pretend to be local time utilities. They try to gather private information from developer environments read more about Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.