Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets  Ravie Lakshmanan  Mar 11, 2026 Artificial Intelligence / Developer Security Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors. The Rust packages, published to crates.io, are listed below - chrono_anchor dnp3times time_calibrator time_calibrators time-sync The crates, per Socket, impersonate timeapi.io and were published between late February and early March 2026. It's assessed to be the work of a single threat actor based on the use of the same exfiltration methodology and the lookalike domain ("timeapis[.]io") to stash the stolen data. "Although the crates pose as local time utilities, their core behavior is credential and secret theft," security researcher Kirill Boychenko said . "They attempt to collect sensitive data from developer environments, most notably .env files, and exfiltrate it to threat actor-controlled infrastructure." While four of the aforementioned packages exhibit fairly straightforward capabilities to exfiltrate .env files, "chrono_anchor" goes a step further by implementing obfuscation and operational changes so as to avoid detection. The crates were advertised as a way to calibrate local time without relying on the Network Time Protocol (NTP). "Chrono_anchor" incorporates the exfiltration logic within a file named "guard.rs" that's invoked from an "optional sync" helper function so as to avoid raising developer suspicions. Unlike other malware, the code observed in this case does not aim to set up persistence on the host through a service or scheduled task. Instead, the crate attempts to repeatedly exfiltrate .env secrets every time the developer of a Continuous Integration (CI) workflow calls the malicious code. The targeting of .env files is no accident, as it's typically used to hold API keys, tokens, and other secrets, allowing an attacker to compromise downstream users and gain deeper access to their environments, including cloud services, databases, and GitHub and registry tokens. While the packages have since been removed from crates.io, users who may have accidentally downloaded them are advised to assume possible exfiltration, rotate keys and tokens, audit CI/CD jobs that run with publish or deploy credentials, and limit outbound network access where possible. "This campaign shows that low-complexity supply chain malware can still deliver high-impact when it runs inside developer workspaces and CI jobs," Socket said. "Prioritize controls that stop malicious dependencies before they execute." AI-Powered Bot Exploits GitHub Actions The disclosure follows the discovery of an automated attack campaign that targeted CI/CD pipelines spanning major open-source repositories, with an artificial intelligence (AI)-powered bot called hackerbot-claw scanning public repositories for exploitable GitHub Actions workflows to harvest developer secrets. Between February 21 and February 28, 2026, the GitHub account, which described itself as an autonomous security research agent, targeted no less than seven repositories belonging to Microsoft, Datadog, and Aqua Security, among others. The attack unfolds as follows - Scan public repositories for misconfigured CI/CD pipelines Fork target repository and ready a malicious payload Open a pull request with a trivial change such as a typo fix, while concealing the main payload in the branch name, file name, or a CI script Trigger the CI pipeline by taking advantage of the fact that workflows are automatically activated on every pull request, causing the malicious code to be executed on the build server Steal secrets and access tokens One of the highest-profile targets of the attack was the repository "aquasecurity/trivy," a popular security scanner from Aqua Security that searches for known vulnerabilities, misconfigurations, and secrets. "Hackerbot-claw exploited a pull_request_target workflow to steal a Personal Access Token (PAT)," supply chain security company StepSecurity said. "The stolen credential was then used to take over the repository." In a statement issued last week, Aqua Security's Itay Shakury revealed that the attacker leveraged the GitHub Actions workflow to push a malicious version of Trivy's Visual Studio Code (VS Code) extension to the Open VSX registry to leverage local AI coding agents to collect and exfiltrate sensitive information. Socket, which also investigated the extension compromise, said the injected logic in versions 1.8.12 and 1.8.13 executes local AI coding assistants, including Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI, in highly permissive modes, instructing them to perform extensive system inspection, generate a report of discovered information, and save the results to a GitHub repository named "posture-report-trivy" using the victim's own authenticated GitHub CLI session. Aqua has since removed the artifacts from the marketplace and revoked the token used to publish them. Users who installed the extensions are advised to immediately remove them, check for the presence of unexpected repositories, and rotate environment secrets. The malicious artifact has been removed. No other affected artifacts have been identified. The incident is being tracked under the CVE identifier CVE-2026-28353 . It's worth pointing out that for a system to be impacted by the issue, the following prerequisites need to be fulfilled - Version 1.8.12 or 1.8.13 was installed from Open VSX At least one of the targeted AI coding CLIs was installed locally The CLI accepted the permissive execution flags provided The agent was able to access sensitive data on disk The GitHub CLI was installed and authenticated (for version 1.8.13) "The progression from .12 to .13 looks like iteration," Socket said. "The first prompt scatters data across random channels with no reliable way for the attacker to collect the output. The second fixes that problem by using the victim's own GitHub account as a clean exfiltration channel, but its vague instructions might cause the agent to push secrets to a private repo the attacker can't see." Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE      Tweet  Share  Share  Share   Share on Facebook  Share on Twitter  Share on Linkedin  Share on Reddit  Share on Hacker News  Share on Email  Share on WhatsApp Share on Facebook Messenger  Share on Telegram SHARE  artificial intelligence , CI/CD Security , Credential Theft , cybersecurity , Developer Security , GitHub , Malware , Open Source Security , Rust , Supply Chain Security Trending News ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1 ⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack and Vibe-Coded Malware ThreatsDay Bulletin: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Privacy Fine and More Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday Popular Resources Self-Hosted WAF: Block SQLi, XSS, and Bots Before They Reach Your Apps 19,053 Confirmed Breaches in 2025 – Key Trends and Predictions for 2026 Read CYBER360 2026: From Zero Trust Limits to Data-Centric Security Paths Identity Controls Checklist: Find Missing Protections in Apps