{"id":"GHSA-658g-p7jg-wx5g","revision":"d32e77552c3848ac85f94c4a73e13d69","records":[{"revision":"d32e77552c3848ac85f94c4a73e13d69","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-658g-p7jg-wx5g","aliases":["CVE-2026-34841"],"title":"Axios npm Supply Chain Incident Impacting @usebruno/cli","description":"### **Impact**\n\nThis is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).\n\nUsers of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.\n\nPotential impact includes:\n\n* Execution of a malicious `postinstall` script\n* Remote Access Trojan (RAT) installation\n* Exfiltration of credentials and sensitive data\n\n**Not impacted:**\n\n* Bruno desktop app users\n* Users who installed outside the attack window\n\n\n### **Patches**\n\nThe compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.\n\nAdditionally, Bruno has taken further hardening steps:\n\n* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases\n* Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)\n\n\n### **Recommendation**\n\nIf users installed **@usebruno/cli** during the affected window:\n1. Reinstall dependencies\n2. Rotate all credentials and secrets:\n\nFor additional guidance on securing your system, refer to this article:\nhttps://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat","state":0,"publishedAt":"2026-04-02T18:34:04+00:00","modifiedAt":"2026-04-06T23:49:31.823224+00:00","affected":[{"ecosystem":"npm","name":"@usebruno/cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.2.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g","https://nvd.nist.gov/vuln/detail/CVE-2026-34841","https://github.com/axios/axios/issues/10604","https://github.com/usebruno/bruno/pull/7632","https://github.com/advisories/GHSA-fw8c-xr5c-95f9","https://github.com/usebruno/bruno","https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat"],"sourceUrl":"https://github.com/advisories/GHSA-658g-p7jg-wx5g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-658g-p7jg-wx5g","identifiers":["GHSA-658g-p7jg-wx5g","CVE-2026-34841"]},"retained":false,"historicalAffected":[]}],"coverage":[]}