| Package | Affected versions | Patched versions |
|---|---|---|
| bruno | < 3.2.1 | 3.2.1 |
| @usebruno/cli | < 3.2.1 | 3.2.1 |
This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).
Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted.
Potential impact includes:
postinstall scriptNot impacted:
The compromised axios versions (1.14.1, 0.30.4) have been removed from npm, and new installations will now resolve to safe versions.
Additionally, Bruno has taken further hardening steps:
axios to a known safe version to prevent accidental resolution to malicious releasesIf users installed @usebruno/cli during the affected window:
For additional guidance on securing your system, refer to this article: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free