postman-cli@1.66.0
Official Postman CLI - Command-line companion for API development, testing, and automation
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe postinstall hook makes an unconsented persistent change to foreign AI-agent instruction files, which can affect later agent behavior. The limited instruction content and global-install trigger do not remove that control-surface risk.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A global npm installation of postman-cli.
Impact
Future agent sessions may receive the inserted Postman CLI instruction as part of their configuration.
Mechanism
The hook detects Claude Code and Codex configuration locations and appends a Postman CLI availability instruction without a separate agent-configuration consent check.
Policy narrative
During global npm installation, the package automatically appends a Postman CLI availability instruction to detected Claude Code or Codex instruction files. The hook does not ask separately before changing those agent control surfaces. No credential access or network transfer was identified in the inspected behavior.
AI rationale
The postinstall hook makes an unconsented persistent change to foreign AI-agent instruction files, which can affect later agent behavior. The limited instruction content and global-install trigger do not remove that control-surface risk.
Evidence
package.jsonscripts/post-npm-installation.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs a postinstall script that changes detected agent instruction files.
- On global installation, it automatically appends Postman availability instructions to supported agent configuration files.
- The script targets Claude Code and Codex instruction files, which can influence later agent behavior.
Evidence against
- The hook runs only for global npm installations and skips other installs.
- The added instruction is limited to Postman CLI availability; no credential access or network transfer was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/post-npm[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg53"postinstall": "node ./scripts/post-npm[redacted]"
},
"man": "./man/postman.1",
High
Suspicious Lifecycle Evidence
The package runs a postinstall script that changes detected agent instruction files.
package.jsonView on unpkg · L53scripts/post-npm-installation.jsView file
67[redacted]: 'CLAUDE_CONFIG_DIR',
L68: fallbackDirectory: '.claude',
L69: instructionFileNames: ['CLAUDE.md'],
L70: postConfiguration: ({ configurationResult, invocationDirectory }) => {
L71: const projectConfigurationDetected = invocationDirectory ?
L72: isDirectory(path.join(invocationDirectory, '.claude')) :
L73: false;
...
L82: [redacted]: 'CODEX_HOME',
L83: fallbackDirectory: '.codex',
L84: instructionFileNames: ['AGENTS.override.md', 'AGENTS.md']
L85: }
...
L199:
Findings
1 Critical6 High2 Medium3 Low
CriticalAi Agent Control Hijackscripts/post-npm-installation.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/post-npm-installation.js#virtual:normalized:round1
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to postman-cli@1.66.0.
See all versions of postman-cli for other recorded verdicts.
- Avoid installing postman-cli@1.66.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.