Bruno IDE was affected by a supply chain attack targeting the axios npm package. The compromised package introduced a hidden dependency that deployed a cross-platform Remote Access Trojan (RAT). Users who installed @usebruno/cli between 00:21 UTC and 03:30 UTC on March 31, 2026 may have been compromised. The attack vector was through compromised versions of the axios npm package. Users are advised to upgrade to Bruno version 3.2.1 to mitigate the vulnerability.