time_calibrator

time_calibrator is a malicious Rust crate published to crates.io that masqueraded as a time-related utility and was identified by Socket as one of five related malicious packages, alongside chrono_anchor, dnp3times, time_calibrators, and time-sync. The crates impersonated the legitimate service timeapi.io and used the lookalike domain timeapis[.]io for exfiltration. Its core behavior was credential and secret theft rather than legitimate time calibration functionality: the package attempted to collect sensitive data from developer environments, especially .env files, and exfiltrate the contents to threat actor-controlled infrastructure. The activity was assessed as likely conducted by a single threat actor based on shared infrastructure and exfiltration methodology across the crate set. The package was advertised as calibrating local time without relying on NTP, but the reported behavior indicates straightforward .env exfiltration. The malware did not establish persistence via services or scheduled tasks, but attempted repeated exfiltration whenever the malicious code was invoked in developer workstations or CI workflows, creating software supply-chain risk. Stolen .env contents could include API keys, tokens, and other secrets, potentially enabling downstream compromise of cloud services, databases, GitHub, and registry accounts. The crate was removed from crates.io. It was also observed as a dependency in the GitHub repository aestik6/Polymarket-crypto-5min-arbitrage-bot, which was referenced in reporting on the broader Contagious Trader cryptocurrency-themed malware campaign.