Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors. The Rust packages, published to crates.io, are listed below - chrono_anchor dnp3times time_calibrator time_calibrators time-sync The crates, per Socket, impersonate timeapi.io and were published between late February and early March 2026. It's assessed to be the work of a single threat actor based on the use of the same exfiltration methodology and the lookalike domain ("timeapis[.]io") to stash the stolen data. "Although the crates pose as local time utilities, their core behavior is credential and secret theft," security researcher Kirill Boychenko said. "They attempt to collect sensitive data from developer environments, most…