registry / postman-cli / 1.74.0
postman-cli@1.74.0
Official Postman CLI - Command-line companion for API development, testing, and automation
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe install hook automatically writes to global agent instruction files during global npm installation, which warrants a warning under the agent extension lifecycle policy. The added content only advertises Postman CLI availability, and the inspected source does not establish a malicious attack chain.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package globally with npm when a supported agent configuration directory exists.
Impact
Future agent sessions may receive the added Postman CLI instruction. The inspected source does not establish prompt or response export, remote execution, or another concrete attack.
Mechanism
The hook appends a marked instruction block to the selected global instruction file.
AI rationale
The install hook automatically writes to global agent instruction files during global npm installation, which warrants a warning under the agent extension lifecycle policy. The added content only advertises Postman CLI availability, and the inspected source does not establish a malicious attack chain.
Evidence
package.jsonscripts/post-npm-installation.js.claude/CLAUDE.mdCLAUDE_CONFIG_DIR/CLAUDE.md.codex/AGENTS.override.md.codex/AGENTS.mdCODEX_HOME/AGENTS.override.mdCODEX_HOME/AGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs its post-installation script automatically after installation.
- The script changes agent instructions only for global npm installations and only when a configured agent directory exists.
- It appends a short instruction saying Postman CLI is available; it does not replace existing instructions.
- The affected global instruction files are for Claude Code and Codex.
- The CLI entry point forwards the supplied arguments to a platform-specific Postman binary.
Evidence against
- The inspected installation script uses filesystem, operating-system, and path operations to configure instructions; no network sender or secret transfer appears in that source.
- The installation guard and directory check limit the configuration change to global installs with a detected agent directory.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/post-npm[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg53"postinstall": "node ./scripts/post-npm[redacted]"
},
"man": "./man/po
Medium
Ai Review Evidence
The package runs its post-installation script automatically after installation.
package.jsonView on unpkg · L53scripts/post-npm-installation.jsView file
67[redacted]: 'CLAUDE_CONFIG_DIR',
L68: fallbackDirectory: '.claude',
L69: instructionFileNames: ['CLAUDE.md'],
L70: postConfiguration: ({ configurationResult, invocationDirectory }) => {
L71: const projectConfigurationDetected = invocationDirectory ?
L72: isDirectory(path.join(invocationDirectory, '.claude')) :
L73: false;
...
L82: [redacted]: 'CODEX_HOME',
L83: fallbackDirectory: '.codex',
L84: instructionFileNames: ['AGENTS.override.md', 'AGENTS.md']
L85: }
...
L199:
Critical
Findings
1 Critical3 High5 Medium3 Low
CriticalAi Agent Control Hijackscripts/post-npm-installation.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/post-npm-installation.js#virtual:normalized:round1
HighKnown Malware Source Fingerprint Signatureindex.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencescripts/post-npm-installation.js
MediumAi Review Evidencescripts/post-npm-installation.js
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to postman-cli@1.74.0.
See all versions of postman-cli for other recorded verdicts.
- Review the evidence and your use of postman-cli@1.74.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.