postman-cli@1.65.0
Official Postman CLI - Command-line companion for API development, testing, and automation
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package has an automatic postinstall hook that writes to detected Claude Code and Codex instruction files during global npm installs without a consent guard. This meets the policy for unconsented mutation of a broad AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A global npm installation of postman-cli.
Impact
The added instructions alter the context available to those agents in later work; the hook provides no consent prompt for these changes.
Mechanism
The hook detects Claude Code and Codex configuration roots and appends Postman CLI instructions to an instruction file when the marker is absent.
Policy narrative
During a global npm install, the postinstall hook detects Claude Code and Codex configuration directories and appends Postman CLI instructions to their global instruction files without asking first. Those changes affect the instructions available to the agents in future sessions.
AI rationale
The package has an automatic postinstall hook that writes to detected Claude Code and Codex instruction files during global npm installs without a consent guard. This meets the policy for unconsented mutation of a broad AI-agent control surface.
Evidence
package.jsonscripts/post-npm-installation.jsCLAUDE.mdAGENTS.override.mdAGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- The package's postinstall hook automatically launches the installer script.
- On global npm installs, the hook configures detected agent instruction files without a consent check.
- The installer appends package-provided instructions to those files, including Codex global instruction files.
Evidence against
- The hook returns without configuring agents for non-global npm installs.
- The appended text identifies Postman CLI availability and includes an optional plugin installation suggestion.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/post-npm[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg52"scripts": {
"postinstall": "node ./scripts/post-npm[redacted]"
},
"man": "./man/pos
High
Suspicious Lifecycle Evidence
The package's postinstall hook automatically launches the installer script.
package.jsonView on unpkg · L52scripts/post-npm-installation.jsView file
67[redacted]: 'CLAUDE_CONFIG_DIR',
L68: fallbackDirectory: '.claude',
L69: instructionFileNames: ['CLAUDE.md'],
L70: postConfiguration: ({ configurationResult, invocationDirectory }) => {
L71: const projectConfigurationDetected = invocationDirectory ?
L72: isDirectory(path.join(invocationDirectory, '.claude')) :
L73: false;
...
L82: [redacted]: 'CODEX_HOME',
L83: fallbackDirectory: '.codex',
L84: instructionFileNames: ['AGENTS.override.md', 'AGENTS.md']
L85: }
...
L199:
Findings
1 Critical6 High2 Medium3 Low
CriticalAi Agent Control Hijackscripts/post-npm-installation.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/post-npm-installation.js#virtual:normalized:round1
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to postman-cli@1.65.0.
See all versions of postman-cli for other recorded verdicts.
- Avoid installing postman-cli@1.65.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.