What
Claude Code can now read where a plugin came from, either from a JSON file placed next to the plugin or from a map in the CLAUDE_CODE_PLUGIN_ATTRIBUTION environment variable. It yields a server-side plugin id (plugin_ plus letters and digits), a marketplace name and an installation preference. The variable is unset by default, and it is now stripped from the environment handed to spawned subprocesses so it does not leak into tools.
Details
- Malformed input is ignored with a warning rather than failing plugin load, for example when the value is not a JSON object.
- Presence of the variable is itself a reason to build a scrubbed child environment before spawning.
Evidence
Ignoring CLAUDE_CODE_PLUGIN_ATTRIBUTION: not a JSON object
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleCLAUDE_CODE_PLUGIN_ATTRIBUTION
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this build
New in this build: CLAUDE_CODE_PLUGIN_ATTRIBUTION