Group of 2 Under the hood
Claude Code now tracks which installed plugins come from an attested official marketplace and drops that attestation if it conflicts
What
- Plugin loading now looks up each installed plugin's
officialAttestation(whether its source is a known, official marketplace) and records this for plugins loaded by path, including synced and skill plugins. - A new check scans installed plugin sources and, if a source's attestation conflicts with a value seen for it before, or the source isn't in the known set of official marketplaces, that source's attestation is removed so it's no longer treated as official.
Why
This keeps Claude Code from mistakenly treating a plugin as coming from an official marketplace when its source has changed or doesn't match what was previously recorded, which matters for any trust or safety decisions based on plugin origin.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
The finding does not say what effect the attestation has on plugin behavior or trust indicators shown to the user.