CVE-2026-34841: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34841 is a supply chain attack vulnerability affecting @usebruno/cli, the CLI component of Bruno — an open-source API testing IDE. The attack was carried out through compromised versions of the axios npm package (versions 1.14.1 and 0.30.4), which introduced a hidden dependency that deployed a cross-platform Remote Access Trojan (RAT). Only users who ran npm install for @usebruno/cli between 00:21 UTC and ~03:30 UTC on March 31, 2026 were potentially impacted; Bruno desktop app users were not affected. All versions of @usebruno/cli prior to 3.2.1 are considered vulnerable. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Bruno Advisory).

The root cause is classified under CWE-494 (Download of Code Without Integrity Check) and CWE-506 (Embedded Malicious Code). A maintainer's GitHub and npm accounts for the axios project were reportedly compromised, enabling the attacker to publish malicious versions (1.14.1 and 0.30.4) to the npm registry (axios Issue). These versions contained a hidden dependency that executed a malicious postinstall script during npm install, which silently deployed a cross-platform RAT on the victim's system without requiring any user interaction beyond the standard package installation process (Github Advisory). The attack exploited the trust developers place in widely-used transitive dependencies and the lack of integrity verification for npm packages resolved via semver ranges (Bruno Advisory).

Successful exploitation results in full system compromise on affected developer machines. The malicious postinstall script installs a cross-platform RAT, granting attackers persistent remote access and the ability to exfiltrate credentials, API keys, secrets, and other sensitive data stored on or accessible from the compromised system. Given that Bruno is an API testing tool, affected systems are likely to contain high-value credentials such as API tokens, authentication secrets, and environment configuration files, significantly amplifying the risk of downstream service compromise and lateral movement (Github Advisory, axios Malware Advisory).

The attack was a time-limited supply chain incident active between 00:21 UTC and ~03:30 UTC on March 31, 2026, during which the compromised axios versions were live on npm. No public proof-of-concept exploit exists, and no evidence of ongoing active exploitation has been reported post-remediation (Github Advisory). The EPSS score is approximately 0.021–0.029%, reflecting low probability of future exploitation given the malicious packages have been removed from npm. The vulnerability is not listed in the CISA KEV catalog. The attack required no privileges or user interaction beyond a routine npm install command, making it highly effective during the active window (Bruno Advisory).

1. Account Compromise: The attacker compromised a maintainer's GitHub and npm accounts for the axios project, gaining the ability to publish new package versions to the npm registry (axios Issue).
2. Malicious Package Publication: The attacker published two trojanized versions of axios — 1.14.1 and 0.30.4 — to the npm registry, embedding a hidden dependency and a malicious postinstall script within the package.
3. Dependency Resolution: When a developer ran npm install for @usebruno/cli (versions < 3.2.0) during the attack window (00:21–03:30 UTC, March 31, 2026), npm resolved the axios dependency to one of the compromised versions due to semver range matching.
4. Postinstall Script Execution: npm automatically executed the malicious postinstall script included in the compromised axios package as part of the standard installation lifecycle, requiring no additional user interaction.
5. RAT Deployment: The postinstall script downloaded and installed a cross-platform Remote Access Trojan on the victim's system, establishing persistent remote access for the attacker.
6. Credential Exfiltration: With the RAT active, the attacker could remotely access the compromised developer machine and exfiltrate stored credentials, API keys, secrets, and other sensitive data (Github Advisory).

• Network: Unexpected outbound connections from developer workstations to unknown external IPs or C2 infrastructure, particularly originating from Node.js or npm processes shortly after package installation on March 31, 2026.
• File System: Presence of unexpected binaries or scripts in npm cache directories or temporary folders created during the npm install of @usebruno/cli versions < 3.2.0; unexpected files in the axios package directory (node_modules/axios/) inconsistent with known-good versions.
• Process: Unusual child processes spawned by Node.js or npm during or after installation (e.g., shell processes, download utilities like curl or wget, or unfamiliar executables); persistent background processes not associated with normal Bruno operation.
• Logs: npm install logs referencing axios versions 1.14.1 or 0.30.4; system logs showing execution of unexpected scripts during the installation window (00:21–03:30 UTC, March 31, 2026).
• Package Artifacts: package-lock.json or node_modules containing axios 1.14.1 or 0.30.4 as resolved versions (Github Advisory, axios Malware Advisory).

Users who installed @usebruno/cli during the attack window (00:21–03:30 UTC, March 31, 2026) should immediately upgrade to @usebruno/cli version 3.2.1, which pins axios to the known-safe version 1.13.6 and adds a root-level npm override to prevent resolution to malicious releases (Bruno PR #7632). All credentials, API keys, and secrets accessible from potentially affected systems must be rotated immediately from a separate, uncompromised machine. Additionally, run npm audit to check for known vulnerabilities, use package-lock.json to lock dependency versions, and consider setting min-release-age=30 in .npmrc to avoid newly published packages. Any system that installed the compromised axios versions should be treated as fully compromised and subjected to forensic investigation (Github Advisory, Aikido Blog).

The Bruno team responded rapidly, publishing a security advisory (GHSA-658g-p7jg-wx5g) on March 31, 2026 and merging a fix (PR #7632) the same day to pin axios to version 1.13.6 across all workspace packages (Bruno Advisory). Aikido Security published a detailed blog post analyzing the compromised axios maintainer account and the RAT deployment mechanism, which was referenced directly in the official Bruno advisory (Aikido Blog). StepSecurity also published analysis of the incident, noting the likely account compromise vector (axios Issue). The incident received coverage from The Hacker Wire and discussion on Mastodon, highlighting broader community concerns about supply chain security in the npm ecosystem.