What
Claude Code keeps a provenance record for each installed plugin, which is a note of where the plugin came from. That record no longer has an npmResolution field. The field held the npm packageName and tarballUrl, and it has been removed from both the schema (the definition of what the record may contain) and the code that builds the record.
The trust check changed along with it:
- The plugin trust function no longer has a case that treated a plugin as trusted when its
npmResolutionpassed a check.
Why
Plugins installed from npm are no longer recorded with these npm details, and those details no longer make a plugin trusted. If you relied on npm-sourced plugins being trusted this way, other criteria now decide whether they are trusted.