CVE-2026-34841: Axios npm supply chain attack via @usebruno/cli

CVE-2026-34841 · Severity: critical · CVSS 9.8 · Published 2026-04-06

@usebruno/cli is a command-line tool for the Bruno API testing platform. Between March 31 and April 1, 2026, users who ran npm install during a specific window received compromised versions of the axios dependency that deployed a remote access trojan (RAT). This allowed attackers to execute arbitrary code on developer machines, steal credentials and sensitive data, and maintain persistent access to affected systems.

Technologies: Axios. Vendors: Axios, npm.

Quick answers

Is CVE-2026-34841 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34841 being exploited in the wild.
How severe is CVE-2026-34841?
Critical severity, with a CVSS score of 9.8, published 6 April 2026.
Which products and versions are affected?
Axios 1.14.1, 0.30.4 (compromised); affected versions distributed through @usebruno/cli < 3.2.0; @usebruno/cli (npm) SEMVER:introduced=0,fixed=3.2.1.
Is there a fix for CVE-2026-34841?
Yes. @usebruno/cli (npm): upgrade to 3.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34841 attacked?
It is attacked over the network.
Am I affected by CVE-2026-34841?
Check whether you run Axios, @usebruno/cli (npm) or Usebruno Bruno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @usebruno/cli (npm): upgrade to 3.2.1 or later
    npm install @usebruno/cli@3.2.1

Technical details

This is a supply chain attack targeting the axios npm package through dependency injection. Compromised versions (1.14.1 and 0.30.4) introduced a malicious postinstall script that executed a cross-platform RAT. The attack affected @usebruno/cli users who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026. The vulnerability is classified as improper integrity checking of downloaded code (CWE-494) and embedded malicious code (CWE-506). No user interaction or privileges are required—the exploit occurs automatically during package installation. Patches involve removing compromised axios versions from npm and pinning @usebruno/cli to safe versions (3.2.1+).

Affected products

  • Bruno @usebruno/cli < 3.2.1
  • Axios axios 1.14.1, 0.30.4 (compromised); affected versions distributed through @usebruno/cli < 3.2.0

Identifiers

  • CVE-2026-34841
  • GHSA-658g-p7jg-wx5g

Timeline

  • 2026-03-31: exploited: Supply chain attack active between 00:21 UTC and ~03:30 UTC on March 31, 2026
  • 2026-03-31: disclosed: Advisory published
  • 2026-04-02: patched: @usebruno/cli version 3.2.1 released; compromised axios versions removed from npm

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.