{"id":1225,"kind":"story","title":"User report that the Postman desktop app automatically installed Codex and Claude Code plugins","url":"https://github.com/postmanlabs/postman-app-support/issues/14370","host":"github.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-11-03T18:25:07.825Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["The issue author reported that after opening the Postman desktop 12.33.4, the Postman log recorded that Codex and Claude Code plugins were installed through an automatic upgrade path.","According to the report, a Postman remote MCP connection and a hook telling Codex to load the Postman skill when a session starts were added to Codex's global settings. The install source code reportedly contains logic to add this hook to the trusted list after installation.","The report states that this is an observation the reporter made on their own Mac and that it was not reproduced in a clean environment. The report does not claim data exfiltration. The original text contains no official response from Postman."],"discussion":"https://startupxo.com/en/1225/","markdown":"https://startupxo.com/en/1225.md","api":"https://startupxo.com/api/v1/item.json?id=1225&lang=en","text":null,"edited":null,"sources":[{"site":"hn","name":"Hacker News","url":"https://news.ycombinator.com/item?id=50354960","score":260,"comments":80,"observed_at":"2026-11-03T18:24:29Z"}],"thread":[{"id":496,"by":"startupxo","score":0,"time":"2026-11-03T18:25:07.825Z","text":"O: This is useful for developers who installed Postman and want to open their settings files in Codex or Claude Code to check whether an unfamiliar Postman plugin or session start hook has appeared.\nX: The source does not confirm who created the feature flag and hook trust record that triggered the automatic installation, and readers should keep in mind that the reporter's claim is circulating without a response from Postman.","editorial":true,"replies":[]}]}