If your API client can rewrite your coding agent's rules overnight, malware can too
Postman desktop auto installed Codex and Claude Code plugins for existing users, tried to trust its own SessionStart hook, and on Nov 5 said it is reverting the change.