What is the CVSS score of CVE-2026-34841?

CVE-2026-34841 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-34841?

A critical supply chain attack compromised the @usebruno/cli npm package through malicious axios dependencies, delivering a remote access trojan to developer workstations with no authentication…. A patch is available.

How to fix or mitigate CVE-2026-34841?

24 hours: Identify all developer workstations with @usebruno/cli installed; assume all systems in scope are compromised and isolate from sensitive networks pending forensics. Initiate mandatory credential rotation for all users who worked on affected systems during the attack window (00:21-03:30 UTC March 31, 2026). 7 days: Upgrade @usebruno/cli to patched version via vendor PR #7632 (pins axios to non-malicious versions); conduct forensic imaging of affected endpoints for RAT artifacts and persistence mechanisms; review logs for unauthorized access and data exfiltration. 30 days: Complete incident investigation; verify all compromised credentials are rotated; deploy EDR/SIEM alerts for known RAT indicators of compromise; decommission any systems with active RAT persistence that cannot be fully remediated.

Node.js CVE-2026-34841

EUVD-2026-19354 CRITICAL

Download of Code Without Integrity Check (CWE-494)

2026-04-02 https://github.com/usebruno/bruno

GHSA-658g-p7jg-wx5g

Information Disclosure Node.js

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 02, 2026 - 19:01 euvd

EUVD-2026-19354

Analysis Generated

Apr 02, 2026 - 19:01 vuln.today

Patch released

Apr 02, 2026 - 19:01 nvd

Patch available

CVE Published

Apr 02, 2026 - 18:34 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Impact

This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).

Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted.

Potential impact includes:

Execution of a malicious postinstall script
Remote Access Trojan (RAT) installation
Exfiltration of credentials and sensitive data

Not impacted:

Bruno desktop app users
Users who installed outside the attack window

Patches

The compromised axios versions (1.14.1, 0.30.4) have been removed from npm, and new installations will now resolve to safe versions.

Additionally, Bruno has taken further hardening steps:

Pinned axios to a known safe version to prevent accidental resolution to malicious releases
Fix implemented in: https://github.com/usebruno/bruno/pull/7632

Recommendation

If users installed @usebruno/cli during the affected window:

Reinstall dependencies
Rotate all credentials and secrets:

For additional guidance on securing your system, refer to this article: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat

AnalysisAI

Supply chain compromise of @usebruno/cli (Bruno API testing tool) deployed a cross-platform Remote Access Trojan via malicious axios dependency versions 1.14.1 and 0.30.4 on npm during a 3-hour window (00:21-03:30 UTC, March 31, 2026). Unauthenticated remote attackers gained full system compromise including credential exfiltration and persistent RAT installation on affected developer workstations. No public exploit code required as the malicious payload executed automatically via npm postinstall

Technical ContextAI

This vulnerability exemplifies a dependency confusion supply chain attack (CWE-494) targeting the Node.js/npm ecosystem. The attack compromised the widely-used axios HTTP client library by publishing malicious versions (1.14.1, 0.30.4) to the npm registry, likely through maintainer account hijacking. When @usebruno/cli (pkg:npm/@usebruno_cli) resolved its axios dependency during the attack window, npm's package resolution mechanism pulled the compromised versions. The malicious package included a postinstall lifecycle script that executed automatically during npm install, deploying a cross-platform RAT without requiring user interaction. This attack vector exploits the implicit trust relationship in dependency chains where transitive dependencies (axios as a dependency of @usebruno/cli) execute arbitrary code during installation. The RAT payload provided persistent remote access capabilities and implemented data exfiltration functionality targeting credentials and sensitive files. Bruno's mitigation strategy of dependency pinning prevents future automatic resolution to compromised versions, addressing the CWE-494 root cause of uncontrolled dependency version resolution.

RemediationAI

Organizations must immediately identify any systems where @usebruno/cli was installed between 00:21 UTC and 03:30 UTC on March 31, 2026 and treat them as compromised requiring incident response procedures. For affected systems: perform complete credential rotation including API keys, passwords, tokens, and certificates accessible from the compromised workstation; conduct forensic analysis to identify potential data exfiltration and lateral movement; consider full system reimaging or thorough malware scanning to remove RAT persistence mechanisms. For all users: upgrade to patched @usebruno/cli version incorporating fix from https://github.com/usebruno/bruno/pull/7632 which pins axios to known-safe versions and prevents resolution to compromised packages. Execute npm install with cleared cache (npm cache clean --force) to ensure malicious packages are not retained locally. The compromised axios versions (1.14.1, 0.30.4) have been removed from npm registry, so fresh installations after 03:30 UTC March 31, 2026 automatically resolve to safe versions. Additional security guidance and indicators of compromise available at https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat. Organizations should implement dependency pinning and software composition analysis tools to detect future supply chain attacks.