Socket’s Threat Research Team discovered a coordinated supply chain campaign in the Rust ecosystem where five malicious crates (chrono_anchor, dnp3times, time_calibrator, time_calibrators, time-sync) posed as time utilities but covertly exfiltrated .env secrets to attacker-controlled infrastructure. Four crates were rapidly yanked from crates.io while chrono_anchor used minor obfuscation to remain live until reported and removed. #chrono_anchor #timeapis
Keypoints
- Five malicious Rust crates published between late February and early March 2026 attempted to exfiltrate local .env files and other secrets from developer and CI environments.
- All crates shared identical exfiltration logic and infrastructure, including a lookalike domain timeapis[.]io that impersonated timeapi.io, indicating a single coordinated campaign.
- RustSec and the GitHub Advisory Database show crates.io yanked four packages quickly; chrono_anchor remained listed until Socket reported it and crates.io suspended the publisher.
- chrono_anchor used cover traffic (HTTPS GET to timeapi[.]io) then downgraded to HTTP POST to timeapis[.]io and uploaded .env via curl -F file=@{ENV_FILE_PATH}, triggered unconditionally from parameter validation code.
- The threat actor used naming strategies (typosquatting and brandjacking) and disposable identities/emails to blend in and rotate publishers, e.g., dnp3times and chrono_anchor with publisher dictorudin and emails at kaoing[.]com.
- Recommendations include preventing execution of malicious dependencies (cargo-audit, cargo-deny, Socket tools), rotating secrets if exfiltration is suspected, restricting outbound network access in CI, and pinning/reviewing new crates.
MITRE Techniques
- [T1195.002 ] Supply Chain Compromise – Malicious crates were published to the registry to deliver exfiltration code (‘a coordinated supply chain campaign in the Rust ecosystem involving five malicious crates’)
- [T1204 ] User Execution – The malicious code executes when developers or CI run affected code paths, causing unintentional outbound requests (‘any code path that validates parameters, including tests, can cause silent outbound traffic and secret leakage’)
- [T1036 ] Masquerading – The actor used lookalike names and typosquatting (chron_anchor, dnp3times) to appear legitimate (‘typosquatted the legitimate dnp3time crate’ and ‘borrows the recognition of the widely-used chrono ecosystem’)
- [T1552.001 ] Unsecured Credentials: Credentials In Files – The crates target .env files to harvest credentials stored in developer workflows (‘.env files because they are simple, portable, and fit naturally into dotenv-style workflows’)
- [T1005 ] Data from Local System – The malicious workflow reads and uploads local files (ENV_FILE_PATH resolves to .env and the crate uploads that file via curl -F file=@{ENV_FILE_PATH})
- [T1583.001 ] Acquire Infrastructure: Domains – The campaign used attacker-controlled and lookalike domains to receive exfiltrated data (‘a lookalike domain, timeapis[.]io, that impersonates the legitimate… timeapi.io service’)
- [T1071.001 ] Application Layer Protocol: Web Protocols – Exfiltration uses HTTP(S) requests and curl to send data to remote endpoints (‘Silent GET with a 3s timeout via external curl’ and ‘Multipart POST upload via curl’)
- [T1041 ] Exfiltration Over C2 Channel – The crates perform covert exfiltration of secrets to an external upload endpoint (‘uploads the local secrets file path (typically “.env”)’ to http://timeapis[.]io/api/Time/current/zone?timeZone=UTC)
Indicators of Compromise
- [Malicious crates ] crates used for .env exfiltration – chrono_anchor, dnp3times, and 3 more (time_calibrator, time_calibrators, time-sync)
- [Exfiltration endpoints ] attacker-controlled domain and upload URL – http://timeapis[.]io/api/Time/current/zone?timeZone=UTC, timeapis[.]io
- [Threat actor aliases ] publisher/user identities observed on crates.io/GitHub – dictorudin, gehakax777, and 1 more (suntea279491)
- [Email addresses ] disposable author emails found in manifests – gehakax777@kaoing[.]com, jack@kaoing[.]com
- [GitHub accounts ] linked repository/homepage fields in crate manifests – https://github[.]com/suntea279491, https://github[.]com/dictorudin
- [File path ] targeted local secret file – .env (ENV_FILE_PATH resolves to .env)
Read more: https://socket.dev/blog/5-malicious-rust-crates-posed-as-time-utilities-to-exfiltrate-env-files