Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. dnp3times
  4. ›
  5. GHSA-xhw7-jhmp-j62j

GHSA-xhw7-jhmp-j62j: `dnp3times` was removed from crates.io due to malicious code

March 5, 2026

The dnp3times crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service. It was loosely trying to typosquat the dnp3time crate, but otherwise was the same attack as the recent time_calibrator and time_calibrators malware.

The malicious crate had 1 version published on 2026-03-04 approximately 6 hours before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.

References

  • github.com/advisories/GHSA-xhw7-jhmp-j62j
  • rustsec.org/advisories/RUSTSEC-2026-0032.html

Code Behaviors & Features

Detect and mitigate GHSA-xhw7-jhmp-j62j with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions

Solution

Unfortunately, there is no solution available yet.

Source file

cargo/dnp3times/GHSA-xhw7-jhmp-j62j.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:17:19 +0000.