{"version":"2.1.269","anchor":"extractionpackage-integrity-check-hardened-permission-stri","canonical_anchor":"extractionpackage-integrity-check-hardened-permission-stri","heading":"Extraction\/package integrity check hardened: permission stripping and tamper detection","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/extractionpackage-integrity-check-hardened-permission-stri","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### Extraction\/package integrity check hardened: permission stripping and tamper detection\n\nPackage integrity checks now catch tampering via file permissions and hard links, not just size or symlinks\n\n**What**\n\nWhen Claude Code verifies the integrity of an extracted package, it now opens each file or directory with a flag that refuses to follow symbolic links, checks that files have exactly one hard link, and strips any group- or world-writable permission bits it finds. The directory-walk integrity check now flags a result as 'tampered' if a file isn't a plain file or fails this new permission check, in addition to the existing 'oversize', 'symlink', and 'reserved' failure outcomes.\n\n**Why**\n\nThis closes off ways a malicious or corrupted package could exploit file permissions, hard links, or symlink tricks during extraction, giving Claude Code a stronger guarantee that extracted files match what was intended.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}