GCVE-110-OSM-2026-8442

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 18, 2026

`time_calibrator` was removed from crates.io due to malicious code Details: It was reported `time_calibrator` contained malicious code, that would try to upload `.env` files to a server. The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user account was locked. There were no crates depending on this crate on crates.io. Thanks to Gabriel Silva for finding and reporting this to the Rust security response working group, and thanks to Emily Albini for co-ordinating with the crates.io and infra-admin teams.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	time_calibrator	all (affected)	—

References

Malicious crates package: time_calibrator

advisory

vendor

Browse GCVE Records

75,874 records in the GCVE database · Updated August 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON