{"version":"2.1.323","anchor":"plugin-provenance-no-longer-carries-npmresolution","canonical_anchor":"plugin-provenance-no-longer-carries-npmresolution","heading":"Plugins no longer use npmResolution for provenance or trust","tier":"notice","area":"Plugins","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/plugin-provenance-no-longer-carries-npmresolution","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Plugins no longer use npmResolution for provenance or trust\n\nThe npmResolution field is gone from plugin provenance, and plugins are no longer trusted on the basis of an npmResolution check\n\n**What**\n\nClaude Code keeps a provenance record for each installed plugin, which is a note of where the plugin came from. That record no longer has an `npmResolution` field. The field held the npm `packageName` and `tarballUrl`, and it has been removed from both the schema (the definition of what the record may contain) and the code that builds the record.\n\nThe trust check changed along with it:\n\n- The plugin trust function no longer has a case that treated a plugin as trusted when its `npmResolution` passed a check.\n\n**Why**\n\nPlugins installed from npm are no longer recorded with these npm details, and those details no longer make a plugin trusted. If you relied on npm-sourced plugins being trusted this way, other criteria now decide whether they are trusted.\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}