You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
RemovedKind: in v2.1.323,
RemovedSection of the release
What
When Claude Code installs a plugin from npm, it can check the downloaded file against a checksum, a fingerprint the registry publishes so you can tell the download was not altered. There used to be a strict mode that refused the install when the registry reported no checksum to check against.
That strict mode is gone. Claude Code now:
Checks the older-style checksum whenever the registry provides one.
Installs the package unverified, with a warning, when the registry provides no checksum of either kind.
Why
This loosens a safety check. A plugin package that comes without any checksum is now installed rather than refused, so watch for the warning if you care where your plugins come from.
