Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
https://thehackernews.com/2026/03/five-malicious-rust-crates-and-ai-bot.html
Publish Date: 2026-03-11 01:12:00
Source Domain: thehackernews.com
Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors.
The Rust packages, published to crates.io, are listed below –
- chrono_anchor
- dnp3times
- time_calibrator
- time_calibrators
- time-sync
The crates, per Socket, impersonate timeapi.io and were published between late February and early March 2026. It’s assessed to be the work of a single threat actor based on the use of the same exfiltration methodology and the lookalike domain (“timeapis[.]io”) to stash the stolen data.
“Although the crates pose as local time utilities, their core behavior is credential and secret theft,” security researcher Kirill Boychenko said. “They attempt to collect sensitive data from developer environments, most notably .env files, and exfiltrate it to threat actor-controlled infrastructure.”
While four of the aforementioned packages exhibit fairly straightforward capabilities to exfiltrate .env files, “chrono_anchor” goes a step further by implementing obfuscation and operational changes so as to avoid detection. The crates were advertised as a way to calibrate local time without relying on the Network Time Protocol (NTP).
“Chrono_anchor” incorporates the exfiltration logic within a file named “guard.rs” that’s invoked from an “optional sync” helper function so as to avoid raising developer suspicions. Unlike other malware, the code observed in this case does not aim to set up persistence on the host through a service or scheduled task.
Instead, the crate attempts to repeatedly exfiltrate .env secrets every time the developer of a Continuous Integration (CI) workflow calls the malicious code.
The targeting of .env files is no accident, as it’s typically used to hold API keys, tokens, and other secrets, allowing an attacker to compromise downstream users and gain deeper access to their environments, including cloud services, databases, and GitHub and registry tokens.
While the…
