Postman被指擅自安装Claude Code与Codex插件
Postman日志和安装器源码显示，其桌面版会自动安装用户级Claude Code与Codex插件，其中一条安装路径还会尝试写入Codex启动Hook的信任状态。另一名用户称Postman 12.35.1也出现了自动安装，但其配置中没有Hook批准记录。Postman表示捆绑安装是为减少设置工作，并会检讨选择加入及Hook批准机制，但尚未公布修正版本或时间表。
据报告，Postman桌面版可在用户未明确选择的情况下修改编码智能体配置，并在特定路径下自动批准启动Hook。
A heads-up for Claude Code users who also have Postman installed: after I opened Postman on my Mac for the first time in a while, a local audit found that its desktop auto-installer had installed and enabled a Claude Code plugin at user scope. The same run installed a Codex plugin too.
I asked Codex to inspect the logs, configuration and cached installer source. I consider an API client changing unrelated coding-agent setups a serious consent and trust problem. I have removed the app and integrations.
Direct Claude Code evidence
Postman's main.log at 2026-10-24T09:34:14.418Z records:
text PostmanAgentPluginService~install: script completed {"source":"auto-existing-upgrade","results":["claude-code:installed","codex:installed"],"installer":"script"}
The next entry says autoInstall.plugin.existing-user finished with outcome installed, signedIn true, useScript true, and scriptResults claude-code:installed,codex:installed.