# 5 malicious Rust crates pose as time utilities to exfiltrate .env files

> Five crates published between late February and early March 2026 posed as local time utilities while exfiltrating .env files via `curl` to a lookalike domain `timeapis.io` (typosquatting `timeapi.io`). All packages were 0.1.0 and yanked within hours. Account aliases: `gehakax777`, `dictorudin`.

- Published: 2026-02-28
- Severity: medium
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: crates.io
- Scope: 5 packages, 5 compromised versions
- Tags: typosquat, credential-theft
- Detected by: Socket
- Incident ID: crates-2026-02-28-time-utility-typosquats

## Affected packages (5)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [chrono_anchor](https://dependencywatch.io/package/crates/chrono_anchor) | crates.io | 0.1.0 |
| [dnp3times](https://dependencywatch.io/package/crates/dnp3times) | crates.io | 0.1.0 |
| [time_calibrator](https://dependencywatch.io/package/crates/time_calibrator) | crates.io | 0.1.0 |
| [time_calibrators](https://dependencywatch.io/package/crates/time_calibrators) | crates.io | 0.1.0 |
| [time-sync](https://dependencywatch.io/package/crates/time-sync) | crates.io | 0.1.0 |

## What happened

Between late February and early March 2026, five crates appeared on crates.io under two publishing handles - `gehakax777` and `dictorudin` - all posing as local time utilities. Names included `chrono_anchor`, `dnp3times`, `time_calibrator`, `time_calibrators`, and `time-sync`. Each was published at exactly version `0.1.0`, which is the early-tell.

On build, the crates execute a `curl` to a lookalike domain `timeapis.io` - a typosquat of the legitimate `timeapi.io` - uploading the contents of any `.env` file found on the host. The payload is small (a single shell-out, no obfuscation), which is consistent with the broader pattern of opportunistic Rust-side credential theft this quarter.

All five crates were yanked by crates.io within hours of Socket's disclosure, and combined download counts stayed in the low double digits, so direct exposure is limited. The takeaway is process-level: any crate at `0.1.0` with no prior version history posing as a near-name of a known utility should be treated as suspect, and CI should run `cargo-audit` plus a `cargo-deny` denylist for known-malicious names.

## Impact

- .env file theft including API keys, tokens, and credentials
- Targets developer workstations and CI runners
- Low download counts but represents continuing typosquat pattern

## What to do

1. Block egress to `timeapis.io` and remove the listed crates from `Cargo.lock`
2. Rotate credentials on any host that built with the malicious crates
3. Add `cargo-deny` rules for known-malicious crate names

## References

- [Socket: 5 malicious Rust crates posed as time utilities](https://socket.dev/blog/5-malicious-rust-crates-posed-as-time-utilities-to-exfiltrate-env-files) - Socket

---

Canonical page: https://dependencywatch.io/incident/crates-2026-02-28-time-utility-typosquats
Markdown version: https://dependencywatch.io/incident/crates-2026-02-28-time-utility-typosquats.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).