Vulnerabilities in Claude Code plugin marketplace

A security researcher found a way to hijack repository names referenced by Anthropic's official plugin marketplace. A repo-jacking attack is possible if a plugin author deletes or renames their GitHub account, leaving an outdated link in the catalog.

An attacker can register the freed-up name and create a repository with malicious content. Although plugin installation is protected by SHA checks, which prevent execution of compromised code, navigating to the plugin's homepage remains a phishing vector.

Anthropic closed the report as informational, citing that social engineering is outside the bug bounty program. Experts advise treating all third-party plugins as untrusted code.