A user reports that opening Postman on macOS unexpectedly triggered the automatic installation of Postman plugins for Codex and Claude Code. The installer allegedly modified global configurations, enabled a remote MCP connection, and attempted to self-approve its own startup hook. Evidence from Postman's logs and Codex's config files shows the plugin was installed via an 'auto-existing-upgrade' script on October 24, 2026.
The installed hook instructs Codex to route broad API engineering tasks through Postman skills, bypassing user intent. The installer source code explicitly contains logic to approve Postman's hook immediately after installation, raising severe consent and trust-boundary concerns.
Source: Hacker News · Summarized by HeadlinesBriefing