CVE-2026-34841: Axios npm Supply Chain Incident Impacting @usebruno/cli

<strong>Impact</strong>

This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).

Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted.

Potential impact includes:

• Execution of a malicious postinstall script
• Remote Access Trojan (RAT) installation
• Exfiltration of credentials and sensitive data

Not impacted:

• Bruno desktop app users
• Users who installed outside the attack window

<strong>Patches</strong>

The compromised axios versions (1.14.1, 0.30.4) have been removed from npm, and new installations will now resolve to safe versions.

Additionally, Bruno has taken further hardening steps:

• Pinned axios to a known safe version to prevent accidental resolution to malicious releases
• Fix implemented in: https://github.com/usebruno/bruno/pull/7632

<strong>Recommendation</strong>

If users installed @usebruno/cli during the affected window:

1. Reinstall dependencies
2. Rotate all credentials and secrets:

For additional guidance on securing your system, refer to this article: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat