postman-cli@1.69.0
Official Postman CLI - Command-line companion for API development, testing, and automation
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe postinstall hook mutates detected global Claude Code and Codex instruction files without consent, matching the policy for install-time AI-agent control-surface hijacking. The behavior is limited to appending a package-specific instruction block, but its automatic lifecycle trigger makes the mutation an active attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package globally through npm.
Impact
Future agent sessions may be influenced by newly added package instructions.
Mechanism
The hook detects Claude Code or Codex configuration directories and appends Postman availability instructions to their instruction files without asking first.
Policy narrative
A global npm installation automatically runs the postinstall hook. When it finds a Claude Code or Codex configuration directory, the hook appends a Postman instruction block to its agent instruction file without consent. This is an install-time mutation of AI-agent control surfaces.
AI rationale
The postinstall hook mutates detected global Claude Code and Codex instruction files without consent, matching the policy for install-time AI-agent control-surface hijacking. The behavior is limited to appending a package-specific instruction block, but its automatic lifecycle trigger makes the mutation an active attack surface.
Evidence
package.jsonscripts/post-npm-installation.js~/.claude/CLAUDE.md~/.codex/AGENTS.override.md~/.codex/AGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- `package.json` runs the configuration script from `postinstall`.
- On global installs, the hook configures detected Claude Code and Codex global instruction directories without a consent check.
- The script appends Postman instructions to agent instruction files, changing their future control context.
Evidence against
- The change is limited to global agent instruction files and appends a Postman-specific block rather than replacing existing instructions.
- No network transfer or credential handling is shown in the inspected install hook.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/post-npm[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg52"scripts": {
"postinstall": "node ./scripts/post-npm[redacted]"
},
"
High
Suspicious Lifecycle Evidence
`package.json` runs the configuration script from `postinstall`.
package.jsonView on unpkg · L52scripts/post-npm-installation.jsView file
67[redacted]: 'CLAUDE_CONFIG_DIR',
L68: fallbackDirectory: '.claude',
L69: instructionFileNames: ['CLAUDE.md'],
L70: postConfiguration: ({ configurationResult, invocationDirectory }) => {
L71: const projectConfigurationDetected = invocationDirectory ?
L72: isDirectory(path.join(invocationDirectory, '.claude')) :
L73: false;
...
L82: [redacted]: 'CODEX_HOME',
L83: fallbackDirectory: '.codex',
L84: instructionFileNames: ['AGENTS.override.md', 'AGENTS.md']
L85: }
...
L199:
Critical
Findings
1 Critical6 High2 Medium3 Low
CriticalAi Agent Control Hijackscripts/post-npm-installation.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/post-npm-installation.js#virtual:normalized:round1
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to postman-cli@1.69.0.
See all versions of postman-cli for other recorded verdicts.
- Avoid installing postman-cli@1.69.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.