{"id":"CVE-2026-34841","aliases":["EUVD-2026-19354","GHSA-658g-p7jg-wx5g"],"status":"published","title":"Axios npm Supply Chain Incident Impacting @usebruno/cli","description":"Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00241,"percentile":0.15242,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-494","CWE-506"],"published":"2026-04-02T18:34:04Z","modified":"2026-10-23T23:10:00Z","fixes":[{"ecosystem":"npm","package":"@usebruno/cli","fixed_in":["3.2.0","3.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@usebruno/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@usebruno/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}]}],"products":[{"vendor":"usebruno","product":"bruno"}],"references":[{"url":"https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g","tags":["x_refsource_CONFIRM","Mitigation","Patch","Vendor Advisory","web"]},{"url":"https://github.com/axios/axios/issues/10604","tags":["x_refsource_MISC","Issue Tracking","web"]},{"url":"https://github.com/usebruno/bruno/pull/7632","tags":["x_refsource_MISC","Issue Tracking","Patch","web"]},{"url":"https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat","tags":["x_refsource_MISC","Mitigation","Press/Media Coverage","web"]},{"url":"https://github.com/advisories/GHSA-fw8c-xr5c-95f9","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34841","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-658g-p7jg-wx5g"},{"url":"https://github.com/usebruno/bruno","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34841","title":"Axios npm Supply Chain Incident Impacting @usebruno/cli","description":"Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1","status":"published","published":"2026-04-06T16:08:08.198Z","modified":"2026-04-08T03:55:33.96Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-494","CWE-506"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-19354","description":"Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1","status":"published","published":"2026-04-06T16:08:08Z","modified":"2026-04-08T03:55:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:12.431163Z"}],"ghsa":[{"id":"GHSA-658g-p7jg-wx5g","title":"Axios npm Supply Chain Incident Impacting @usebruno/cli","description":"### **Impact**\n\nThis is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).\n\nUsers of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.\n\nPotential impact includes:\n\n* Execution of a malicious `postinstall` script\n* Remote Access Trojan (RAT) installation\n* Exfiltration of credentials and sensitive data\n\n**Not impacted:**\n\n* Bruno desktop app users\n* Users who installed outside the attack window\n\n\n### **Patches**\n\nThe compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.\n\nAdditionally, Bruno has taken further hardening steps:\n\n* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases\n* Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)\n\n\n### **Recommendation**\n\nIf users installed **@usebruno/cli** during the affected window:\n1. Reinstall dependencies\n2. Rotate all credentials and secrets:\n\nFor additional guidance on securing your system, refer to this article:\nhttps://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat","status":"published","published":"2026-04-02T18:34:04Z","modified":"2026-04-06T23:41:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-494","CWE-506","CWE-1395"],"updated_at":"2026-11-02T14:39:50.076383Z"}],"nvd":[{"id":"CVE-2026-34841","description":"Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1","status":"published","published":"2026-04-06T17:17:10.59Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-494","CWE-506"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"GHSA-658g-p7jg-wx5g","title":"Axios npm Supply Chain Incident Impacting @usebruno/cli","description":"### **Impact**\n\nThis is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).\n\nUsers of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.\n\nPotential impact includes:\n\n* Execution of a malicious `postinstall` script\n* Remote Access Trojan (RAT) installation\n* Exfiltration of credentials and sensitive data\n\n**Not impacted:**\n\n* Bruno desktop app users\n* Users who installed outside the attack window\n\n\n### **Patches**\n\nThe compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.\n\nAdditionally, Bruno has taken further hardening steps:\n\n* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases\n* Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)\n\n\n### **Recommendation**\n\nIf users installed **@usebruno/cli** during the affected window:\n1. Reinstall dependencies\n2. Rotate all credentials and secrets:\n\nFor additional guidance on securing your system, refer to this article:\nhttps://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat","status":"published","published":"2026-04-02T18:34:04Z","modified":"2026-04-06T23:49:31.823224Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1395","CWE-494","CWE-506"],"updated_at":"2026-11-02T15:46:39.266402Z"}]}}