Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@usebruno/cli

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8npmPublished

    Axios npm Supply Chain Incident Impacting @usebruno/cli

    CVE-2026-34841 · GHSA-658g-p7jg-wx5g

    Affected
    • npm @usebruno/cli < 3.2.1
    Fixed in
    3.2.1· Vendor fix available
    Issue
    Impact This is a supply chain attack involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran `npm install` between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Potential impact includes: * Execution of a malicious `postinstall` script * Remote Access Trojan (RAT) installation * Exfiltration of credentials and sensitive data Not impacted: * Bruno desktop app users * Users who installed outside the attack window Patches The compromised `axios` versions (`1.14.1`, `0.30.4`) have been removed from npm, and new installations will now resolve to safe versions. Additionally, Bruno has taken further hardening steps: * Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases * Fix implemented in:…

    Recommended action: Upgrade to 3.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →