GitHub Advisoryadvisory · crates.io
GHSA-xhw7-jhmp-j62j `dnp3times` was removed from crates.io due to malicious code
CRITICAL
Official page ↗
- Ecosystem
- crates.io
- Packages
- dnp3times
- Severity
- Critical
- Reviewed
- 2026-03-05
Affected packages
• crates.io dnp3times: all versions (no fix yet)
Description
The `dnp3times` crate attempted to exfiltrate `.env` files to a server that was in turn impersonating the legitimate `timeapi.io` service. It was loosely trying to typosquat the `dnp3time` crate, but otherwise was the same attack as the recent `time_calibrator` and `time_calibrators` malware.
The malicious crate had 1 version published on 2026-03-04 approximately 6 hours before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.