You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PluginsArea: what it touches
Bug FixesKind: in v2.1.265,
Bug FixesSection of the release
What
Plugin loading now looks up each installed plugin's officialAttestation (whether its source is a known, official marketplace) and records this for plugins loaded by path, including synced and skill plugins.
A new check scans installed plugin sources and, if a source's attestation conflicts with a value seen for it before, or the source isn't in the known set of official marketplaces, that source's attestation is removed so it's no longer treated as official.
Why
This keeps Claude Code from mistakenly treating a plugin as coming from an official marketplace when its source has changed or doesn't match what was previously recorded, which matters for any trust or safety decisions based on plugin origin.
