{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "time_calibrators",
        "purl": "pkg:cargo/time_calibrators"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-wf45-3gpw-vrqv"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The `time_calibrators` crate attempted to exfiltrate `.env` files to a server\nthat was in turn impersonating the legitimate `timeapi.io` service.\n\nThe malicious crate had 1 version published on 2026-03-03 approximately 3 hours\nbefore removal and had no evidence of actual downloads. There were no crates\ndepending on this crate on crates.io.\n\nThanks to cybergeek for finding and reporting this to the Rust security\nresponse working group, and thanks to Emily Albini for co-ordinating with the\ncrates.io team.",
  "id": "RUSTSEC-2026-0031",
  "modified": "2026-03-05T05:53:11Z",
  "published": "2026-03-03T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/time_calibrators"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0031.html"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "`time_calibrators` was removed from crates.io due to malicious code"
}