CVE-2026-34841: @usebruno/cli Axios Npm Supply Chain Incident Vulnerability

CRITICAL
Advisory Identifier: GHSA-658g-p7jg-wx5g
Share
CVSS 9.8
CWE-494 CWE-1395 CWE-506
Published
Advisory Summary

CVE-2026-34841 is a CRITICAL (CVSS 9.8) axios npm supply chain incident vulnerability (CWE-494: Download of Code Without Integrity Check) affecting @usebruno/cli libraries in the npm ecosystem. The issue involves axios npm supply chain incident impacting @usebruno/cli. Remediation is available by upgrading affected packages to version 3.2.1.

CVE-2026-34841 at a Glance

CVE Identifier CVE-2026-34841
GHSA Identifier GHSA-658g-p7jg-wx5g
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-494: Download of Code Without Integrity Check
Affected Product @usebruno/cli
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-34841

To remediate this vulnerability, upgrade all affected @usebruno/cli dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@usebruno/cli fixed: 3.2.1 
npm install @usebruno/cli@3.2.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @usebruno/cli

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-34841, inspect your project dependencies using npm:

npm ls @usebruno/cli

Analyze the terminal output to locate any version of @usebruno/cli in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.2.1), your application is affected.

Note: The npm ls @usebruno/cli command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-494: Download of Code Without Integrity Check, where the product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. In @usebruno/cli, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### **Impact** This is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted. Potential impact includes: * Execution of a malicious `postinstall` script * Remote Access Trojan (RAT) installation * Exfiltration of credentials and sensitive data **Not impacted:** * Bruno desktop app users * Users who installed outside the attack window ### **Patches** The compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions. Additionally, Bruno has taken further hardening steps: * Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases * Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632) ### **Recommendation** If users installed **@usebruno/cli** during the affected window: 1. Reinstall dependencies 2. Rotate all credentials and secrets: For additional guidance on securing your system, refer to this article: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat

CVE-2026-34841 Affected @usebruno/cli Versions

1 component(s)
Fixed Versions:
3.2.1
Product / Package Ecosystem Affected Versions Fixed Version
@usebruno/cli
npm/@usebruno/cli
npm
< 3.2.1
3.2.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g
NVD — CVE-2026-34841 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34841
@usebruno/cli Source Repository REPOSITORY
https://github.com/axios/axios/issues/10604
@usebruno/cli Source Repository REPOSITORY
https://github.com/usebruno/bruno/pull/7632
GitHub Advisory / Wiki ADVISORY
https://github.com/advisories/GHSA-fw8c-xr5c-95f9
@usebruno/cli Source Repository REPOSITORY
https://github.com/usebruno/bruno
www.aikido.dev/blog/axios-npm-comp... WEB
https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat

Frequently Asked Questions

What is CVE-2026-34841?
CVE-2026-34841 is a security vulnerability in @usebruno/cli involving Axios npm Supply Chain Incident Impacting @usebruno/cli under CWE-494: Download of Code Without Integrity Check.
Which @usebruno/cli versions are affected?
Affected versions include releases prior to 3.2.1 across affected packages: @usebruno/cli.
What version fixes CVE-2026-34841?
Upgrading to 3.2.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @usebruno/cli affected?
Yes, @usebruno/cli is affected in releases prior to 3.2.1. Upgrade your dependency to 3.2.1 or later.
What is the CVSS score of CVE-2026-34841?
CVE-2026-34841 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-34841?
CVE-2026-34841 is classified under CWE-494: Download of Code Without Integrity Check (The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.).
How can I check npm dependencies for CVE-2026-34841?
Run the dependency tree command: 'npm ls @usebruno/cli'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-658g-p7jg-wx5g",
  "modified" : "2026-04-06T23:41:01Z",
  "published" : "2026-04-02T18:34:04Z",
  "aliases" : [ "CVE-2026-34841" ],
  "summary" : "Axios npm Supply Chain Incident Impacting @usebruno/cli",
  "details" : "### **Impact**\n\nThis is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).\n\nUsers of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.\n\nPotential impact includes:\n\n* Execution of a malicious `postinstall` script\n* Remote Access Trojan (RAT) installation\n* Exfiltration of credentials and sensitive data\n\n**Not impacted:**\n\n* Bruno desktop app users\n* Users who installed outside the attack window\n\n\n### **Patches**\n\nThe compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.\n\nAdditionally, Bruno has taken further hardening steps:\n\n* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases\n* Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)\n\n\n### **Recommendation**\n\nIf users installed **@usebruno/cli** during the affected window:\n1. Reinstall dependencies\n2. Rotate all credentials and secrets:\n\nFor additional guidance on securing your system, refer to this article:\nhttps://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@usebruno/cli"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.2.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 3.2.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34841"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/issues/10604"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/usebruno/bruno/pull/7632"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-fw8c-xr5c-95f9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/usebruno/bruno"
  }, {
    "type" : "WEB",
    "url" : "https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1395", "CWE-494", "CWE-506" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-02T18:34:04Z",
    "nvd_published_at" : "2026-04-06T17:17:10Z"
  }
}