Vulnerabilities in Claude Code plugin marketplace
A security researcher found a way to hijack repository names referenced by Anthropic’s official plugin marketplace. A repo-jacking attack is possible if a plugin author deletes or renames their GitHub account, leaving an outdated link in the catalog.
An attacker can register the freed-up name and create a repository with malicious content. Although plugin installation is protected by SHA checks, which prevent execution of compromised code, navigating to the plugin’s homepage remains a phishing vector.
Anthropic closed the report as informational, citing that social engineering is outside the bug bounty program. Experts advise treating all third-party plugins as untrusted code.
Up next
John Jumper joins Anthropic
Nobel laureate John Jumper, creator of AlphaFold, is leaving Google DeepMind for Anthropic. This is one of the most significant moves in the AI industry this year.
Related stories
- Agentjacking vulnerability exposes Claude Code and Cursor to hijacking via fake error reports
- The .claude directory creates an attack surface in Claude Code
- Claude Code’s sandbox ships as an open-source npm package
- Claude Code stores MCP OAuth tokens in plaintext on Linux
- Miasma attack targets AI assistant configurations
- Apiiro finds Claude Code secrets in 1,122 GitHub files
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.