You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
MarketplaceArea: what it touches
Internal ChangesKind: in v2.1.265,
Bug FixesSection of the release
Unclear The finding does not say what effect the attestation has on plugin behavior or trust indicators shown to the user.
What
Plugin loading now looks up each installed plugin's officialAttestation (whether its source is a known, official marketplace) and records this for plugins loaded by path, including synced and skill plugins.
A new check scans installed plugin sources and, if a source's attestation conflicts with a value seen for it before, or the source isn't in the known set of official marketplaces, that source's attestation is removed so it's no longer treated as official.
Why
This keeps Claude Code from mistakenly treating a plugin as coming from an official marketplace when its source has changed or doesn't match what was previously recorded, which matters for any trust or safety decisions based on plugin origin.
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtThe finding does not say what effect the attestation has on plugin behavior or trust indicators shown to the user.
