Pin axios in bruno-electron due to compromised axios npm release

[timmkrause]

AI-generated notice: this issue was analyzed by AI and created by AI.

Hi Bruno team,

I wanted to report a supply-chain risk in packages/bruno-electron/package.json:

• aws4-axios: ^3.3.0
• axios: ^1.8.3
• axios-ntlm: ^1.4.2

Background:

• Aikido write-up: https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat
• Bruno package file: https://github.com/usebruno/bruno/blob/main/packages/bruno-electron/package.json

The concern is that fresh source installs during the compromise window could resolve the malicious axios@1.14.1 release:

• direct via axios: ^1.8.3
• transitively via axios-ntlm: ^1.4.2 -> axios: ^1.6.1

From what I could verify, Bruno's published GitHub releases do not appear to have been built during the compromise window, so this looks more like a source-build / CI install exposure than a confirmed release-artifact compromise.

Suggested actions:

• pin axios to a known-safe version
• add an override/resolution to prevent bad transitive resolution
• refresh the lockfile
• publish a short clarification for users about whether any official Bruno builds were produced during the affected timeframe

Thanks!

[coderabbitai]

🔗 Related PRs

#6305 - fix: update content security policy to remove unsafe-inline [merged]
#6675 - fix: auth in cli [merged]
#6794 - fix: move yup from peerDependencies to dependencies [merged]
#6849 - chore: update qs package version to 6.14.1 [merged]
#7602 - fix(dependencies): update fast-xml-parser to 5.5.7 and simple-git to … [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[ebesirik]

Are we affected? Any version released with compromised axios?

[timmkrause]

GitHub Security Advisory present now:

GHSA-658g-p7jg-wx5g

Active work is being tracked there as well.