postman-cli@1.75.0

Official Postman CLI - Command-line companion for API development, testing, and automation

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The postinstall hook makes an automatic, global agent instruction change during global npm installation, so a warning is warranted. The appended text is a brief product availability notice, and the inspected source does not establish malicious behavior or data transfer.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package globally with npm.

Impact

The global agent instruction content changes and may influence later agent behavior. No confirmed malicious action or credential transfer was identified.

Mechanism

The hook checks for Claude Code and Codex configuration directories and appends the notice to a selected instruction file if it is not already present.

AI rationale

Evidence

package.jsonscripts/post-npm-installation.js.claude/CLAUDE.md.codex/AGENTS.override.md.codex/AGENTS.md

Decision evidence

public snapshot

AI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script after installation.
The hook only proceeds for a global npm installation, then checks supported agent configurations.
The hook targets global Claude Code and Codex instruction files.
It appends a Postman CLI availability notice to an instruction file when the notice is absent.
The notice only says that Postman CLI is installed and can be used for API engineering work.

Evidence against

The notice is short and product-related, and the append avoids replacing existing instructions.
The inspected hook contains no network transfer; the remaining concern is its automatic modification of agent instructions.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 3 file(s), 15.0 KB of source

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/post-npm[redacted]

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

52"scripts": { "postinstall": "node ./scripts/post-npm[redacted]" }, "man": "./man/pos

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script after installation.

package.jsonView on unpkg · L52

scripts/post-npm-installation.jsView file

67[redacted]: 'CLAUDE_CONFIG_DIR', L68: fallbackDirectory: '.claude', L69: instructionFileNames: ['CLAUDE.md'], L70: postConfiguration: ({ configurationResult, invocationDirectory }) => { L71: const projectConfigurationDetected = invocationDirectory ? L72: isDirectory(path.join(invocationDirectory, '.claude')) : L73: false; ... L82: [redacted]: 'CODEX_HOME', L83: fallbackDirectory: '.codex', L84: instructionFileNames: ['AGENTS.override.md', 'AGENTS.md'] L85: } ... L199:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/post-npm-installation.jsView on unpkg · L67

332function runPostInstallation (environment = process.env) { try { if (!isGlobalInstallation(environment)) { return; } const userHome = operatingSystem.homedir(), invocationDirectory = resolveInvocationDirectory(environment, userHome), configuredAgents = AGENT_CONFIGURATIONS.map((agentConfiguration) => {

Medium

Ai Review Evidence

The hook only proceeds for a global npm installation, then checks supported agent configurations.

scripts/post-npm-installation.jsView on unpkg · L332

68'.claude', instructionFileNames: ['CLAUDE.md'], postConfiguration: ({ configurationResult, invocationDirectory }) => { const projectConfigurationDetecte

Medium

Ai Review Evidence

The hook targets global Claude Code and Codex instruction files.

scripts/post-npm-installation.jsView on unpkg · L68

scripts/post-npm-installation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/post-npm-installation.js#virtual:normalized:round1View on unpkg

index.jsView file

•matchType = malicious_source_fingerprint_signature signature = 4f9bc82635ebc859 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = postman-cli@1.71.0 matchedPath = index.js matchedIdentity = npm:cG9zdG1hbi1jbGk:1.71.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/post-npm[redacted]

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

52"scripts": { "postinstall": "node ./scripts/post-npm[redacted]" }, "man": "./man/pos

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script after installation.

package.jsonView on unpkg · L52

scripts/post-npm-installation.jsView file

Findings

1 Critical3 High5 Medium3 Low

CriticalAi Agent Control Hijackscripts/post-npm-installation.js

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedscripts/post-npm-installation.js#virtual:normalized:round1

HighKnown Malware Source Fingerprint Signatureindex.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencescripts/post-npm-installation.js

LowScripts Present

LowFilesystem

LowNo License

Affected versions and remediation

This report applies to postman-cli@1.75.0.

See all versions of postman-cli for other recorded verdicts.

Review the evidence and your use of postman-cli@1.75.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 06:40:09.189Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.