Postman Silently Installed Itself Into Claude Code and Codex: How to Check and Remove It

Open Postman, and it might quietly rewrite the config files for your coding agents without ever asking you. That's not a hypothetical: it's what happened to Postman desktop users running version 12.33.4 in late October 2026, and the fallout is still playing out as I write this.

Here's the short version: Postman's desktop app pushed an "auto-existing-upgrade" that silently installed its own plugin into Claude Code and Codex on people's machines, then had its installer approve its own startup hook before the user ever saw a prompt. No install dialog. No consent screen. Just a background script writing into files your agent trusts completely.

What actually happened

A developer going by indicava opened GitHub issue #14370 on October 25, 2026, titled "[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook." The timestamped log entry is the smoking gun: at 2026-10-24T09:34:14.418Z, Postman's PostmanAgentPluginService recorded "script completed" with the trigger auto-existing-upgrade and the result claude-code:installed, codex:installed.

That phrase matters. This wasn't a fresh install where you'd expect some setup wizard. This fired on people who already had Postman sitting on their machine, just from opening the app after an update.

Four things changed on disk, none of them requested:

• ~/.codex/config.toml: gained a new Postman marketplace entry, an enabled plugin, and a trusted hash for Postman's SessionStart hook
• ~/.claude/settings.json: enabled the postman@claude-plugins-official plugin at version 2.0.1
• ~/.claude/plugins/installed_plugins.json: recorded the plugin's install metadata
• ~/.local/bin: picked up a new Postman CLI binary, timestamp matching the rest

The Codex plugin landed at version 1.1.0. Both agents now carried a session-start hook telling them to reach for Postman's skill "before responding to any non-trivial API engineering task," and that applied on every project, forever, not just ones where you'd actually opened Postman.

Why the self-approved hook is the real problem

Plenty of tools install plugins without much ceremony. What made this one different is what Postman's installer did to get around Codex's own safety net.

Codex has a hook-approval prompt specifically so that some random app on your laptop can't silently run code inside your coding agent. Per the issue thread, Postman's installer includes a function in codex-hooks.ts that computes the hash of its own hook and writes it straight into the trusted_hash store through config/batchWrite, before you ever see the approval dialog. The one moment you're supposed to get to say no just didn't happen.

Stack on top of that a pre-wired MCP connection to mcp.postman.com, and you've got a background instruction, injected without consent, that persists across every repo on your machine, with a network path back to Postman's servers. For a tool that a lot of teams use to store real production API keys and tokens (healthcare, fintech, you name it), that's not a small thing to wave off.

The issue shot to #1 on Hacker News within days, racking up well over a thousand upvotes and hundreds of comments. A good chunk of that thread wasn't even about the hook: it was people venting about Postman's broader trajectory since it raised north of $400 million and grew past 1,500 employees. I get it. I remember Postman as a small, genuinely good tool for poking at APIs. Somewhere along the way it turned into something that needs you logged into a workspace to send a GET request, and this incident reads like the natural endpoint of that drift.

Check if your machine was affected

Don't take anyone's word for it, including mine. Run these and look for Postman entries:

grep -i "postman" ~/.codex/config.toml
grep -i "postman" ~/.claude/settings.json
cat ~/.claude/plugins/installed_plugins.json | grep -i "postman"
ls -la ~/.local/bin | grep -i "postman"

If any of those return a hit and you don't remember explicitly installing a Postman plugin into Claude Code or Codex, you're one of the affected users.

How to remove it

Postman ships an official uninstaller with the plugin package:

npx @postman/postman-plugin remove
# or, scoped to one agent
npx @postman/postman-plugin status
npx @postman/postman-plugin remove --agent codex

Add -y to skip the confirmation prompt, or --dry-run to see what it would touch before committing. The status command is worth running first: it tells you which agents it detected and whether the plugin is currently active on each.

One catch worth knowing before you declare victory: multiple people who ran the official remover afterward found leftover entries, the marketplace registration in config.toml and the trusted hash in particular weren't always fully cleared. After running the uninstaller, re-run the grep commands above. If anything's still there, open the file and delete the Postman block by hand, then restart Claude Code and Codex so they reload a clean config.

Has Postman fixed this?

As of today, yes, at least the first step. Postman's head of product, Sarabmeet Kallar, acknowledged the auto-install and said the company would make the opt-in clearer and review the hook-approval behavior. Then on November 5, a Postman team member (preethammavin) posted directly on the GitHub issue: "Based on the feedback from the community, we understand this wasn't the case so we will be re-designing the experience with the right level of control. In the meantime, we are reverting this change."

So the auto-install is getting rolled back. That's the right call, and it happened fast for a company that size. But "we're reverting this" isn't the same as "we've explained why an installer script was writing to a security trust store with no prompt in the first place." I'd still manually check your configs even after Postman ships the fix: rollbacks on desktop apps don't always reach every machine cleanly, and an unapproved rollback. Use the outstanding issue thread to track the actual fix version.

If you'd rather not deal with this again

A few people in the HN thread pointed to Bruno, Yaak, and Hoppscotch as alternatives that keep collections as plain files you control and version yourself, instead of a cloud account an app can reach into whenever it wants. I'm not telling you to rage-quit Postman over one bad release. But if your API client is modifying trust stores for tools you didn't even ask it to touch, that's a fair moment to go read up on what else it's doing in the background.

For more on agent-config and supply-chain scares this year, see our coverage of the LiteLLM 1.107.0 backdoor and the OpenCode credential breach. If you're trying to make sense of how Claude Code, Codex, and Cursor are increasingly wired together, our piece on the Reason network covers the plugin ecosystem this incident lives in.

Watch