#developer-tools · Cascadity

MVMaker Views #AI-agents #claude-code #codex #coding-agents #consent #developer-tools #Hacker-News #mcp #postman

Postman reverts a desktop update that installed its plugins into users' Claude Code and Codex without asking

The GitHub issue is a careful, evidence-first report of what changed on one Mac, followed by Postman's response.

A Postman user filed a "[SEVERE]" GitHub issue reporting that opening the Postman desktop app (12.33.4) on a Mac automatically installed Postman plugins into OpenAI's Codex and Anthropic's Claude Code, plus a Postman CLI. Postman's own log recorded an "auto-existing-upgrade" install. The reporter says Codex's global config gained a Postman plugin, a remote MCP server connection and a session-start hook telling the agent to load Postman's skill before any non-trivial API engineering task, and that the plugin's installer source code tries to mark its own hook as trusted. The reporter says the report does not claim any data was exfiltrated.

The issue drew hundreds of reactions. On November 5 a Postman team member replied that the change was meant to simplify setting up coding agents, that the company now understands its messaging did not make that clear, and that Postman is reverting it and will redesign it "with the right level of control." The issue was then closed and locked.

Read it at the source

GitHub[SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook · Issue #14370 · postmanlabs/postman-app-support · GitHub Independent ↗ Hacker NewsDiscussion: Postman silently auto-installs AI plugins and attempts to share all API data Independent ↗

Cascadic Analysis 3

UndertowConfused-deputy / excessive-agency problem

What hidden risk could pull against this, even if the news is good?

The reporter says opening the desktop app added a Postman plugin, a connection to Postman's remote MCP server and a session-start hook telling the agent to load Postman's skill "before responding to any non-trivial API engineering task." A coding agent already has the developer's trust and access to their code; this change gave a vendor a standing say in how that agent works, without the developer choosing it. The reporter does not claim data was taken, and Postman says it is reverting, but the same path would work for someone with worse intentions.

UndertowPersistent memory creates a new poisoning surface

What hidden risk could pull against this, even if the news is good?

The changes landed in user-wide config files for Codex and Claude Code, and the hook runs on startup, clear and compact, so it comes back even after a user wipes the conversation. Instructions written into an agent's persistent setup keep shaping its behavior long after the moment they were added. A user in the thread asked what already-affected people should do, and no answer appears there, which matters because reverting the app update doesn't necessarily undo what was written.

UndertowLoss of meaningful human control as capability and autonomy increase

What hidden risk could pull against this, even if the news is good?

Codex asks users to approve hooks, and the reporter says the installer's own code writes a trust record for Postman's hook, with a comment saying it "approves only Postman's current hook after installation." Approval prompts are where people keep control over what their agents run; software that approves itself removes that checkpoint quietly. The reporter notes the trust record alone doesn't prove who created it, and Postman says it is reviewing the hook approval behavior.

Rabbit Holes 1

Model Context Protocol

After exploring [SEVERE] Desktop auto-installs Codex/Claude plugins; installer attempts to trust its own startup hook · Issue #14370 · postmanlabs/postman-app-support · GitHub, for the plumbing these plugins wire into, read about Model Context Protocol.

The open standard Anthropic introduced in November 2024 for connecting AI systems to external tools and data, later adopted by other major AI providers.

Wikipedia · Wade · 5 min

0

MVMaker Views #backdoor #claude-code #cursor #developer-tools #Hacker-News #ssh #supply-chain-attack #vs-code-extensions

Backdoored copies of the Claude Code extension appear on Cursor's extension marketplace for about 11 hours

Cursor's notice has the timeline, checks and cleanup scripts; Phorion's analysis explains how the backdoor works and why a bug kept it from fully succeeding on Macs.

Cursor says that on October 29, between about 2:27 a.m. and 1:35 p.m. Pacific, its VS Code extension marketplace served maliciously modified versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension for Windows and macOS, versions not made by Anthropic. The code ran as soon as the extension loaded: it sent host and user details to the attacker, added an attacker SSH key labeled "svc-telemetry" to the user's authorized keys, tried to enable SSH and open a reverse tunnel, and set up persistence. Cursor says errors in the malware meant the SSH step failed unless Cursor ran with admin rights. It pulled the versions, shut down and rebuilt the marketplace, rotated keys and had the attacker's server taken offline. Affected users should run its check, remove the key and persistence, and rotate credentials; uninstalling alone may not be enough.

The security firm Phorion, which also detected it, published a technical analysis, including the macOS permission-check mistake that skips turning on Remote Login.

Read it at the source

PhorionOfficial Claude Code Extension Compromise: Security Advisory | Phorion Independent ↗ CursorSecurity notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor ↗ Hacker NewsDiscussion: Backdoor in Claude Code for VS Code extension on the Cursor Marketplace Independent ↗ Help Net SecurityClaude Code extension poisoned with persistent SSH backdoor Independent ↗ BleepingComputerMalicious Claude Code extension on Cursor planted SSH backdoors Independent ↗

Cascadic Analysis 1

UndertowPrivilege escalation + credential propagation

What hidden risk could pull against this, even if the news is good?

A coding-assistant extension runs with the developer's own account, files and network, so a fake version inherits all of it the moment it loads. This one sent host details, tried to add an attacker SSH key and open a reverse tunnel, and set up persistence that survives uninstalling. Cursor says the SSH step usually failed without admin rights, but it still tells users to rotate every credential and session reachable from an affected machine, because the backdoor could have been used to collect more.

Rabbit Holes 2

Supply chain attack

After exploring Official Claude Code Extension Compromise: Security Advisory | Phorion, for the wider pattern, read about Supply chain attack.

Explains attacks that target less secure links in a supply chain, such as tampering with software distribution to plant malware.

Wikipedia · Wade · 5 min

0
Open VSX

After exploring Claude Code extension poisoned with persistent SSH backdoor, why editors like Cursor use a separate extension store is explained in Open VSX.

Open VSX is an open-source registry of VS Code-compatible extensions hosted by the Eclipse Foundation, an alternative to Microsoft's marketplace, whose terms limit it to Microsoft products.

Wikipedia · Wade · 5 min

0