maliciousCovers 0.2.4Reviewed by BitbisonUpdated 2026-10-15
In 2026, the time-sync crate posed as a clock utility and uploaded developers' .env files to a fake time service.
A time utility attempted to upload local secrets
time-sync was a malicious Rust crate distributed as a clock synchronization
utility. It attempted to upload local .env files containing configuration and
potentially service credentials to an attacker-controlled server. This account
explains the reported attack and how to interpret Bitbison's lab detections.
The crate was published on March 4, 2026, and removed from crates.io about
50 minutes later.
RustSec's advisory
identifies the attempted upload but does not describe the code path that
triggered it.
Related crates used a lookalike time service
time-sync was one of five malicious crates published in late February and
early March 2026. The others were time_calibrator, time_calibrators,
dnp3times and chrono_anchor. They posed as time utilities, including claims
of clock calibration without Network Time Protocol (NTP), while attempting to
send .env files to infrastructure impersonating the legitimate timeapi.io
service.
Socket researcher Kirill Boychenko documented the code in chrono_anchor.
Parameter validation and an optional synchronization helper could trigger its
upload, including when those paths ran in tests. The code contacted the real
timeapi.io as cover traffic and used curl to upload .env to the lookalike
domain timeapis.io over an unencrypted connection.
Reported downloads did not establish actual use
At the time of removal, RustSec reported no evidence of actual downloads or use
across the five crates and no dependent crates on crates.io. Socket recorded
a registry count of
66 downloads for chrono_anchor. That count does not establish that its
malicious code ran. According to
RustSec, chrono_anchor
remained available for approximately six days before removal following
Socket's report.
Bitbison detected the upload in a substitute crate
We reproduced the file upload in our lab with a substitute time-sync crate
and a .env file containing test data. Our substitute uploads the file from
its build script so the behavior runs during compilation. This trigger is
specific to our reproduction.
The
recorded run
contains two findings:
- The substitute crate's build script connected to a remote host.
- The build script read the project's
.env file and sent its contents to
that host.
Use the detections below to inspect the processes, file access and connections
from this lab run. The fixture measures outbound transmission; it does not
establish that the receiving application accepted or stored the file.
References
