{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "time_calibrator",
        "purl": "pkg:cargo/time_calibrator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-77xj-rrh3-wx3v"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "It was reported `time_calibrator` contained malicious code, that would try to\nupload `.env` files to a server.\n\nThe malicious crate had only 1 version published at 2026-02-28 and no evidence\nof actual usage. The crate was removed from crates.io and the user account was\nlocked. There were no crates depending on this crate on crates.io.\n\nThanks to Gabriel Silva for finding and reporting this to the Rust security response\nworking group, and thanks to Emily Albini for co-ordinating with the crates.io and\ninfra-admin teams.",
  "id": "RUSTSEC-2026-0030",
  "modified": "2026-03-05T05:53:11Z",
  "published": "2026-03-03T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/time_calibrator"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0030.html"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "`time_calibrator` was removed from crates.io due to malicious code"
}