{"id":"CVE-2026-34841","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-34841","summary":"Axios npm Supply Chain Incident Impacting @usebruno/cli","details":"### **Impact**\n\nThis is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).\n\nUsers of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.\n\nPotential impact includes:\n\n* Execution of a malicious `postinstall` script\n* Remote Access Trojan (RAT) installation\n* Exfiltration of credentials and sensitive data\n\n**Not impacted:**\n\n* Bruno desktop app users\n* Users who installed outside the attack window\n\n\n### **Patches**\n\nThe compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.\n\nAdditionally, Bruno has taken further hardening steps:\n\n* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases\n* Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)\n\n\n### **Recommendation**\n\nIf users installed **@usebruno/cli** during the affected window:\n1. Reinstall dependencies\n2. Rotate all credentials and secrets:\n\nFor additional guidance on securing your system, refer to this article:\nhttps://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat","published":"2026-04-02T18:34:04Z","modified":"2026-04-06T23:49:31.823224Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@usebruno/cli","fixedVersion":"3.2.1"}],"fix":{"url":"https://github.com/usebruno/bruno/pull/7632","label":"usebruno/bruno#7632"},"references":[{"type":"WEB","url":"https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34841"},{"type":"WEB","url":"https://github.com/axios/axios/issues/10604"},{"type":"WEB","url":"https://github.com/usebruno/bruno/pull/7632"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fw8c-xr5c-95f9"},{"type":"PACKAGE","url":"https://github.com/usebruno/bruno"},{"type":"WEB","url":"https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-06T23:49:31.823224Z"}}