{"version":"2.1.323","anchor":"npm-plugin-integrity-check-no-longer-fails-closed-when-regis","canonical_anchor":"npm-plugin-integrity-check-no-longer-fails-closed-when-regis","heading":"npm plugin installs now go ahead unverified when the registry gives no checksum","tier":"notice","area":"Plugins","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/npm-plugin-integrity-check-no-longer-fails-closed-when-regis","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### npm plugin installs now go ahead unverified when the registry gives no checksum\n\nIf the npm registry gives no checksum for a plugin package, Claude Code now installs it unverified with a warning instead of refusing\n\n**What**\n\nWhen Claude Code installs a plugin from npm, it can check the downloaded file against a checksum, a fingerprint the registry publishes so you can tell the download was not altered. There used to be a strict mode that refused the install when the registry reported no checksum to check against.\n\nThat strict mode is gone. Claude Code now:\n\n- Checks the older-style checksum whenever the registry provides one.\n\n- Installs the package unverified, with a warning, when the registry provides no checksum of either kind.\n\n**Why**\n\nThis loosens a safety check. A plugin package that comes without any checksum is now installed rather than refused, so watch for the warning if you care where your plugins come from.\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}