postman-cli@1.71.0
Official Postman CLI - Command-line companion for API development, testing, and automation
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe postinstall hook performs unconsented writes to global Claude Code and Codex instruction files, which control later agent behavior. This supports blocking for lifecycle-driven AI-agent control-surface mutation despite the narrow wording of the inserted instruction.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package globally with npm.
Impact
The install changes instructions that guide future agent behavior, creating an unconsented lifecycle modification of agent control surfaces.
Mechanism
The hook detects existing Claude Code and Codex configuration directories and appends a Postman instruction to the selected global instruction file.
Policy narrative
A global npm install triggers the package’s postinstall hook. When it finds supported agent configuration directories, it appends a Postman availability instruction to their global instruction files. The text is limited, but the install modifies agent control surfaces without a separate consent check.
AI rationale
The postinstall hook performs unconsented writes to global Claude Code and Codex instruction files, which control later agent behavior. This supports blocking for lifecycle-driven AI-agent control-surface mutation despite the narrow wording of the inserted instruction.
Evidence
package.jsonscripts/post-npm-installation.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 87.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs the installer as a postinstall hook.
- The hook runs after global npm installs and targets both Claude Code and Codex global instruction files.
- The installer appends a Postman availability instruction to existing agent instruction files without an in-hook consent check.
- The hook resolves each agent configuration and writes the selected instruction file.
Evidence against
- The appended text is a brief availability notice, and the write is limited to recognized agent configuration directories.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/post-npm[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg53"postinstall": "node ./scripts/post-npm[redacted]"
},
High
Suspicious Lifecycle Evidence
package.json runs the installer as a postinstall hook.
package.jsonView on unpkg · L53scripts/post-npm-installation.jsView file
67[redacted]: 'CLAUDE_CONFIG_DIR',
L68: fallbackDirectory: '.claude',
L69: instructionFileNames: ['CLAUDE.md'],
L70: postConfiguration: ({ configurationResult, invocationDirectory }) => {
L71: const projectConfigurationDetected = invocationDirectory ?
L72: isDirectory(path.join(invocationDirectory, '.claude')) :
L73: false;
...
L82: [redacted]: 'CODEX_HOME',
L83: fallbackDirectory: '.codex',
L84: instructionFileNames: ['AGENTS.override.md', 'AGENTS.md']
L85: }
...
L199:
Critical
Findings
1 Critical6 High2 Medium3 Low
CriticalAi Agent Control Hijackscripts/post-npm-installation.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/post-npm-installation.js#virtual:normalized:round1
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
HighAi Review Evidencescripts/post-npm-installation.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to postman-cli@1.71.0.
See all versions of postman-cli for other recorded verdicts.
- Avoid installing postman-cli@1.71.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.