GCVE-110-OSM-2026-8441

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 18, 2026

`time_calibrators` was removed from crates.io due to malicious code Details: The `time_calibrators` crate attempted to exfiltrate `.env` files to a server that was in turn impersonating the legitimate `timeapi.io` service. The malicious crate had 1 version published on 2026-03-03 approximately 3 hours before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io. Thanks to cybergeek for finding and reporting this to the Rust security response working group, and thanks to Emily Albini for co-ordinating with the crates.io team.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	time_calibrators	all (affected)	—

References

Malicious crates package: time_calibrators

advisory

vendor

Browse GCVE Records

75,874 records in the GCVE database · Updated August 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON