Postman Desktop Allegedly Auto-Installs Codex and Claude Plugins and Self-Approves Startup Hooks

A user filed an issue on GitHub, claiming that after opening Postman Desktop 12.33.4, its logs recorded the automatic installation of Codex plugin 1.1.0 and Claude Code plugin 2.0.1, along with modifications to ~/.codex/config.toml and ~/.claude/settings.json. The user also pointed out that the installed SessionStart hook requires the agent to load the postman:api-engineer skill before handling API engineering tasks, while the installer source code calls approvePostmanHook in an attempt to write hook trust records on its own. The report also documented that the Postman remote MCP failed to start because it requires authentication, and that a Postman CLI appeared in ~/.local/bin; the author stated that they had uninstalled the local installation and integrations and asked maintainers to handle the matter at critical priority.