Five Malicious Rust Crates and AI Bot Target CI/CD Secrets
Summary
Researchers found five Rust crates designed to exfiltrate .env secrets and reported an AI-powered bot targeting GitHub Actions workflows. A stolen token was used to publish malicious Trivy VS Code extensions; affected users were urged to remove them and rotate secrets.
Key points
- Five crates published to crates.io posed as time utilities and targeted .env files containing API keys, tokens, and other secrets.
- The crates impersonated timeapi.io using the lookalike domain timeapis[.]io; chrono_anchor also used obfuscation and a guard.rs routine to repeatedly exfiltrate secrets during CI runs.
- The crates were removed; users were advised to rotate keys and tokens, audit CI/CD jobs with publish or deploy credentials, and limit outbound network access.
- Between February 21 and 28, 2026, hackerbot-claw targeted at least seven repositories, including ones belonging to Microsoft, Datadog, and Aqua Security, using GitHub Actions workflows to harvest secrets.
- StepSecurity said a stolen personal access token was used to take over Aqua Security’s Trivy repository and publish malicious VS Code extension versions 1.8.12 and 1.8.13.
- The extensions directed local AI coding assistants to inspect systems and save findings to a GitHub repository. Aqua removed the artifacts and revoked the publishing token; the incident is tracked as CVE-2026-28353.
Article Details
- Event Type
- Supply-chain attacks involving malicious Rust crates and exploitation of GitHub Actions to compromise a security extension.
- Impact
- The crates stole .env secrets, and the Trivy extension compromise involved theft of a Personal Access Token and publication of malicious extension versions 1.8.12 and 1.8.13. The stolen secrets and credentials could enable access to downstream services and repositories. The crates and extension artifacts have been removed, and Aqua Security revoked the publishing token; users were advised to remove affected extensions, rotate credentials, and audit CI workflows.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | timeapis[.]io | Lookalike domain identified as threat actor-controlled infrastructure used to stash stolen .env data. |
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsMalicious Rust crates published to crates.io masqueraded as time utilities and stole developer secrets, consistent with a compromise through software dependencies.T1195.002 · Compromise Software Supply ChainThe attacker exploited a GitHub Actions workflow to publish malicious versions of the Trivy VS Code extension.T1552.001 · Credentials In FilesThe crates collected sensitive credentials and secrets from .env files.T1567.001 · Exfiltration to Code RepositoryThe malicious extension instructed AI coding assistants to save collected information to a GitHub repository using the victim’s authenticated GitHub CLI session.
CVE
People
Vendors
Aqua Securityand a related AI-powered attack using hackerbot-claw exploited GitHub Actions to compromise Aqua Security’s Trivy extension (CVE-2026-28353), leading to removals and recommendations to rotate keys and auditGitHubimpersonated timeapi.io via timeapis[.]io, and a related AI-powered attack using hackerbot-claw exploited GitHub Actions to compromise Aqua Security’s Trivy extension (CVE-2026-28353), leading to removals and
Products
Claudesaid the injected logic in versions 1.8.12 and 1.8.13 executes local AI coding assistants, including Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI, in highly permissive modes, instructing them to performCodexthe injected logic in versions 1.8.12 and 1.8.13 executes local AI coding assistants, including Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI, in highly permissive modes, instructing them to performGeminilogic in versions 1.8.12 and 1.8.13 executes local AI coding assistants, including Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI, in highly permissive modes, instructing them to perform extensiveGitHub Actionstimeapi.io via timeapis[.]io, and a related AI-powered attack using hackerbot-claw exploited GitHub Actions to compromise Aqua Security’s Trivy extension (CVE-2026-28353), leading to removals andGitHub CLIthe results to a GitHub repository named “posture-report-trivy” using the victim’s own authenticated GitHub CLI session.GitHub Copilot CLIin versions 1.8.12 and 1.8.13 executes local AI coding assistants, including Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI, in highly permissive modes, instructing them to perform extensive system inspection,Kiro CLIand 1.8.13 executes local AI coding assistants, including Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI, in highly permissive modes, instructing them to perform extensive system inspection, generate a reportOpen VSXActions workflow to push a malicious version of Trivy’s Visual Studio Code (VS Code) extension to the Open VSX registry to leverage local AI coding agents to collect and exfiltrate sensitive information.Trivya related AI-powered attack using hackerbot-claw exploited GitHub Actions to compromise Aqua Security’s Trivy extension (CVE-2026-28353), leading to removals and recommendations to rotate keys and audit CI workflows.VSCodethat the attacker leveraged the GitHub Actions workflow to push a malicious version of Trivy’s Visual Studio Code (VS Code) extension to the Open VSX registry to leverage local AI coding agents to collect and