https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:42:55 +0000 https://cve.radiocsirt.org/vuln/cve-2026-34841 <p><strong>Affected:</strong> usebruno bruno</p> <p>Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1</p> <p><strong>Affected:</strong> usebruno bruno</p> <p>Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1</p> https://cve.radiocsirt.org/vuln/cve-2026-34841 https://cve.radiocsirt.org/vuln/ghsa-658g-p7jg-wx5g <p><strong>Affected:</strong> npm: @usebruno/cli</p> <p>### **Impact**</p> <p>This is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).</p> <p>Users of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.</p> <p>Potential impact includes:</p> <p>* Execution of a malicious `postinstall` script * Remote Access Trojan (RAT) installation * Exfiltration of credentials and sensitive data</p> <p>**Not impacted:**</p> <p>* Bruno desktop app users * Users who installed outside the attack window</p> <p>### **Patches**</p> <p>The compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.</p> <p>Additionally, Bruno has taken further hardening steps:</p> <p>* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases * Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)</p> <p>### **Recommendation**</p> <p>If users installed **@usebruno/cli** during the affected window: 1. Reinstall dependencies 2. Rotate all credentials and secrets:</p> <p>For additional guidance on securing your system, refer to this article: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat</p> <p><strong>Affected:</strong> npm: @usebruno/cli</p> <p>### **Impact**</p> <p>This is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).</p> <p>Users of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.</p> <p>Potential impact includes:</p> <p>* Execution of a malicious `postinstall` script * Remote Access Trojan (RAT) installation * Exfiltration of credentials and sensitive data</p> <p>**Not impacted:**</p> <p>* Bruno desktop app users * Users who installed outside the attack window</p> <p>### **Patches**</p> <p>The compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.</p> <p>Additionally, Bruno has taken further hardening steps:</p> <p>* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases * Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)</p> <p>### **Recommendation**</p> <p>If users installed **@usebruno/cli** during the affected window: 1. Reinstall dependencies 2. Rotate all credentials and secrets:</p> <p>For additional guidance on securing your system, refer to this article: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat</p> https://cve.radiocsirt.org/vuln/ghsa-658g-p7jg-wx5g