GitHub Advisoryadvisory · crates.io

GHSA-xhw7-jhmp-j62j `dnp3times` was removed from crates.io due to malicious code

CRITICAL Published 2026-03-05 Modified 2026-03-05 Official page ↗
Ecosystem
crates.io
Packages
dnp3times
Severity
Critical
Reviewed
2026-03-05

Affected packages

• crates.io dnp3times: all versions (no fix yet)

Description

The `dnp3times` crate attempted to exfiltrate `.env` files to a server that was in turn impersonating the legitimate `timeapi.io` service. It was loosely trying to typosquat the `dnp3time` crate, but otherwise was the same attack as the recent `time_calibrator` and `time_calibrators` malware. The malicious crate had 1 version published on 2026-03-04 approximately 6 hours before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.

References