From Dev.to
Postman silently installed AI plugins in its own update. I built a one-command diff for your dev-tool trust surface
Postman 12.33.4 shipped an update that silently auto-installed Claude Code and Codex AI plugins, wrote a trusted hash for its own SessionStart hook, and opened a remote MCP connection. Users found out...