Axios npm Supply Chain Incident Impacting @usebruno/cli
Impact
This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).
Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted.
Potential impact includes:
- Execution of a malicious
postinstallscript - Remote Access Trojan (RAT) installation
- Exfiltration of credentials and sensitive data
Not impacted:
- Bruno desktop app users
- Users who installed outside the attack window
Patches
The compromised axios versions (1.14.1, 0.30.4) have been removed from npm, and new installations will now resolve to safe versions.
Additionally, Bruno has taken further hardening steps:
- Pinned
axiosto a known safe version to prevent accidental resolution to malicious releases - Fix implemented in: https://github.com/usebruno/bruno/pull/7632
Recommendation
If users installed @usebruno/cli during the affected window:
- Reinstall dependencies
- Rotate all credentials and secrets:
For additional guidance on securing your system, refer to this article: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @usebruno/cli | < 3.2.1 | 3.2.1 |
References
- https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g
- https://nvd.nist.gov/vuln/detail/CVE-2026-34841
- https://github.com/axios/axios/issues/10604
- https://github.com/usebruno/bruno/pull/7632
- https://github.com/advisories/GHSA-fw8c-xr5c-95f9
- https://github.com/usebruno/bruno
- https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-1395, CWE-494, CWE-506- Platform
- npm
- Package
@usebruno/cli- Disclosed
- 02.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-658g-p7jg-wx5g - CC BY 4.0
Vulnerability history: @usebruno/cli
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.