Skip to content
Fencer Intel
no cvss —

RUSTSEC-2026-0039 json

`chrono_anchor` was removed from crates.io due to malicious code

published 8mo ago modified 7mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The `chrono_anchor` crate attempted to exfiltrate `.env` files to a server that was in turn impersonating the legitimate `timeapi.io` service.

The malicious crate had 1 version published on 2026-03-04 approximately 6 days before removal and had no evidence of actual downloads. There were no crates depending on this crate on crates.io.

Thanks to [Socket][socket] for reporting this crate. They have published [a blog post][blog] about this recent campaign, and we advise users of `timeapi.io` to exercise caution when using crates to interact with that service.

[socket]: https://socket.dev [blog]: https://socket.dev/blog/5-malicious-rust-crates-posed-as-time-utilities-to-exfiltrate-env-files

Is RUSTSEC-2026-0039 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io chrono_anchor
>=0.0.0-0
 no fix listed

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.