Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors.
The Rust packages, published to crates.io, are listed below –
- chrono_anchor
- dnp3times
- time_calibrator
- time_calibrators
- time-sync
The crates, per Socket, impersonate timeapi.io and were published between late February and early March 2026. It’s assessed to be the work of a single threat actor based on the use of the same exfiltration methodology and the lookalike domain (“timeapis[.]io”) to stash the stolen data.
“Although the crates pose as local time utilities, their core behavior is credential and secret theft,” security researcher Kirill Boychenko said. “They attempt to collect sensitive data from developer environments, most notably .env files, and exfiltrate it to threat actor-controlled infrastructure.”
While four of the aforementioned packages exhibit fairly straightforward capabilities to exfiltrate .env files, “chrono_anchor” goes a step further by implementing obfuscation and operational changes so as to avoid detection. The crates were advertised as a way to calibrate local time without relying on the Network Time Protocol (NTP).
“Chrono_anchor” incorporates the exfiltration logic within a file named “guard.rs” that’s invoked from an “optional sync” helper function so as to avoid raising developer suspicions. Unlike other malware, the code observed in this case does not aim to set up persistence on the host through a service or scheduled task.
Instead, the crate attempts to repeatedly exfiltrate .env secrets every time the developer of a Continuous Integration (CI) workflow calls the malicious code.
The targeting of .env files is no accident, as it’s typically used to hold API keys, tokens, and other secrets, allowing an attacker to compromise downstream users and gain deeper access to their environments, including cloud services, databases, and GitHub and registry tokens.
While the packages have since been removed from crates.io, users who may have accidentally downloaded them are advised to assume possible exfiltration, rotate keys and tokens, audit CI/CD jobs that run with publish or deploy credentials, and limit outbound network access where possible.
“This campaign shows that low-complexity supply chain malware can still deliver high-impact when it runs inside developer workspaces and CI jobs,” Socket said. “Prioritize controls that stop malicious dependencies before they execute.”
AI-Powered Bot Exploits GitHub Actions
The disclosure follows the discovery of an automated attack campaign that targeted CI/CD pipelines spanning major open-source repositories, with an artificial intelligence (AI)-powered bot called hackerbot-claw scanning public repositories for exploitable GitHub Actions workflows to harvest developer secrets.
Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others.
The attack unfolds as follows –
- Scan public repositories for misconfigured CI/CD pipelines
- Fork target repository and ready a malicious payload
- Open a pull request with a trivial change such as a typo fix, while concealing the main payload in the branch name, file name, or a CI script
- Trigger the CI pipeline by taking advantage of the fact that workflows are automatically activated on every pull request, causing the malicious code to be executed on the build server
- Steal secrets and access tokens
One of the highest-profile targets of the attack was the repository “aquasecurity/trivy,” a popular security scanner from Aqua Security that searches for known vulnerabilities, misconfigurations, and secrets.
“Hackerbot-claw exploited a pull_request_target workflow to steal a Personal Access Token (PAT),” supply chain security company StepSecurity said. “The stolen credential was then used to take over the repository.”
In a statement issued last week, Aqua Security’s Itay Shakury revealed that the attacker leveraged the GitHub Actions workflow to push a malicious version of Trivy’s Visual Studio Code (VS Code) extension to the Open VSX registry to leverage local AI coding agents to collect and exfiltrate sensitive information.
Socket, which also investigated the extension compromise, said the injected logic in versions 1.8.12 and 1.8.13 executes local AI coding assistants, including Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI, in highly permissive modes, instructing them to perform extensive system inspection, generate a report of discovered information, and save the results to a GitHub repository named “posture-report-trivy” using the victim’s own authenticated GitHub CLI session.
Aqua has since removed the artifacts from the marketplace and revoked the token used to publish them. Users who installed the extensions are advised to immediately remove them, check for the presence of unexpected repositories, and rotate environment secrets. The malicious artifact has been removed. No other affected artifacts have been identified. The incident is being tracked under the CVE identifier CVE-2026-28353.
It’s worth pointing out that for a system to be impacted by the issue, the following prerequisites need to be fulfilled –
- Version 1.8.12 or 1.8.13 was installed from Open VSX
- At least one of the targeted AI coding CLIs was installed locally
- The CLI accepted the permissive execution flags provided
- The agent was able to access sensitive data on disk
- The GitHub CLI was installed and authenticated (for version 1.8.13)
“The progression from .12 to .13 looks like iteration,” Socket said. “The first prompt scatters data across random channels with no reliable way for the attacker to collect the output. The second fixes that problem by using the victim’s own GitHub account as a clean exfiltration channel, but its vague instructions might cause the agent to push secrets to a private repo the attacker can’t see.”
Pillar Security has assessed hackerbot-claw to be a human operator using a large language model (LLM) as an execution layer. It’s tracking the activity under the moniker Chaos Agent.
The campaign demonstrates “an AI-augmented attacker exploiting CI/CD misconfigurations at speed,” security researcher Eilon Cohen said, adding the supply chain compromise of the Trivy VS Code extension marks the abuse of AI coding agents for data exfiltration. “The hackerbot-claw campaign exploited a gap that most organizations don’t even know exists: zero visibility into AI coding agents running on developer machines, and no runtime controls when those agents are weaponized.”
