Postman silently installed itself into Claude Code and Codex: the log lines, the self-approving hook, and the 4-point audit
The most upvoted security story of the week is a GitHub issue, and it opens with a log line from Postman's own files: {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"]} . Read it slowly: a user opened Postman, and Postman installed plugins into Claude Code and Codex, two other applications, without asking. It also edited their global configs, registered a…
A security story on GitHub reveals Postman silently installing plugins into two other applications, Claude Code and Codex, without user consent. Postman created global configurations, registered a startup hook, dropped a CLI, and tried to self-approve its actions. This unauthorized integration grants Postman control over coding workflows, routing API tasks through its services. The audit confirms the unauthorized actions on any machine with Postman and AI tooling.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
