Postman
Postman helps developers test how apps and websites exchange data. It’s made by Postman, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from postman.com.
What it is
Postman tests APIs, the connections software uses to exchange data. Developers use it to send requests, inspect replies and run repeatable tests. It has a clear purpose on a Mac used for software development.
It handles the passwords, API keys and files used in those tests. Signed-in work normally syncs to Postman’s cloud. The lightweight API Client stores work locally. Enabling its setting to read files outside the working directory also lets third-party collections read files elsewhere on the Mac.
Its optional proxy can inspect network traffic for debugging. Inspecting encrypted HTTPS traffic requires a trusted Postman certificate. This feature can expose the contents of traffic routed through it.
Who makes it
Postman is a software company founded in 2014, headquartered in San Francisco, that makes tools for developing and testing APIs. Its legal name is Postman, Inc.. Its website is postman.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Postman. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.postmanlabs.mac. Download it only from postman.com, not from an ad or a link someone sends you.
Fakes. In October 2024, Palo Alto Networks’ Unit 42 documented malicious adverts leading to a fake Postman download site. Its Windows installer downloaded and ran Lumma Stealer malware.
What it connects to
In normal use, Postman talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
*.postman.com | Postman cloud and desktop connections. |
*.postman.co | Postman cloud and desktop connections. |
*.getpostman.com | Desktop WebSocket connections. |
*.pstmn.io | Downloads and Postman service connections. |
challenges.cloudflare.com | Checks during password sign-in. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Local Network | To send test requests to servers or devices on the local network. |
Security record
Problems with Postman or Postman in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Attackers infected 17 public Postman npm packages, which were subsequently removed; Postman said its apps, production systems and customer data were unaffected. | ↗ | |
| CVE-2024-23738 alleged code execution through settings in older Mac versions, but Postman disputes the report and says those settings do not enable remote code execution. | ↗ |
References
- Fleet software catalogue: Postman for macOS fleetdm.com
- About Postman postman.com
- Postman press and media postman.com
- Postman API Client postman.com
- Set working directory learning.postman.com
- Sync your changes across devices learning.postman.com
- Capture HTTPS traffic using the Postman built-in proxy learning.postman.com
- Download Postman postman.com
- Update Postman learning.postman.com
- Postman release notes postman.com
- Use Postman behind a firewall learning.postman.com
- Postman Community: Cannot connect to local network server community.postman.com
- Unit 42: Fake Postman site distributing Lumma Stealer github.com
- Postman: Root Cause Analysis of Shai-Hulud 2.0 blog.postman.com
- NIST National Vulnerability Database: CVE-2024-23738 nvd.nist.gov