{"id":"RUSTSEC-2026-0039","aliases":[],"status":"published","title":"`chrono_anchor` was removed from crates.io due to malicious code","description":"The `chrono_anchor` crate attempted to exfiltrate `.env` files to a server that\nwas in turn impersonating the legitimate `timeapi.io` service.\n\nThe malicious crate had 1 version published on 2026-03-04 approximately 6 days\nbefore removal and had no evidence of actual downloads. There were no crates\ndepending on this crate on crates.io.\n\nThanks to [Socket][socket] for reporting this crate. They have published\n[a blog post][blog] about this recent campaign, and we advise users of\n`timeapi.io` to exercise caution when using crates to interact with that\nservice.\n\n[socket]: https://socket.dev\n[blog]: https://socket.dev/blog/5-malicious-rust-crates-posed-as-time-utilities-to-exfiltrate-env-files","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-03-10T12:00:00Z","modified":"2026-03-17T22:45:08Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"chrono_anchor","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/chrono_anchor","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0039.html","tags":["advisory"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0039","title":"`chrono_anchor` was removed from crates.io due to malicious code","description":"The `chrono_anchor` crate attempted to exfiltrate `.env` files to a server that\nwas in turn impersonating the legitimate `timeapi.io` service.\n\nThe malicious crate had 1 version published on 2026-03-04 approximately 6 days\nbefore removal and had no evidence of actual downloads. There were no crates\ndepending on this crate on crates.io.\n\nThanks to [Socket][socket] for reporting this crate. They have published\n[a blog post][blog] about this recent campaign, and we advise users of\n`timeapi.io` to exercise caution when using crates to interact with that\nservice.\n\n[socket]: https://socket.dev\n[blog]: https://socket.dev/blog/5-malicious-rust-crates-posed-as-time-utilities-to-exfiltrate-env-files","status":"published","published":"2026-03-10T12:00:00Z","modified":"2026-03-17T22:45:08.50808Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}