Bruno, an open source IDE for API testing, was subject to a supply chain attack via compromised axios npm package versions before 3.2.1. This introduced a hidden dependency that deployed a cross-platform Remote Access Trojan (RAT). The affected versions are those prior to 3.2.1, and the attack window was between 00:21 UTC and approximately 03:30 UTC on March 31, 2026. The vulnerability is classified under CWE-494 (Download of Code Without Integrity Check) and CWE-506 (Embedded Malicious Code). The CVSS v3.1 score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch link or remediation level is provided in the data, but upgrading to version 3.2.1 is recommended.

Successful exploitation results in remote code execution via a hidden RAT, compromising system confidentiality, integrity, and availability. Users who installed dependencies during the specified timeframe may have their systems infected with malware capable of remote access and control. This poses a critical risk to affected systems and data.

Upgrade Bruno to version 3.2.1 or later to eliminate the compromised axios dependency and remove the hidden RAT. Since no official patch link or remediation level is provided, users should verify the upgrade from the official Bruno project sources. Users who installed packages during the attack window should assume compromise and perform thorough system inspections and remediation. Patch status is not yet confirmed by a vendor advisory; check official Bruno communications for current remediation guidance.