Back to rankings

Claude Code Patches a Plugin Credential Leak and Blocks Malicious npm Install Scripts

Claude CodeView original changelog

Claude Code 2.1.275 closed a credential-leak path where a password or token stored in a git, ssh or marketplace URL could show up in plugin and marketplace messages, in logs, in claude plugin marketplace list output, and in the VS Code extension's Manage plugins dialog. The same release changed plugins installed from an npm source to be fetched with npm pack --ignore-scripts and integrity-verified, so a package's install scripts no longer run. Claude in Chrome in auto mode was also changed to skip the extension's per-site check for classifier-approved calls, as bypass mode does.

Key Takeaways

  • Plugin and marketplace URLs no longer leak embedded passwords or tokens in messages, logs, claude plugin marketplace list output, or the VS Code Manage plugins dialog.
  • npm-sourced plugins are now fetched with npm pack --ignore-scripts and integrity-verified, so a package's install scripts no longer run on install.
  • Blocking install scripts closes a well-known supply-chain attack vector for plugin ecosystems.
  • Claude in Chrome in auto mode now skips the extension's per-site check for classifier-approved calls, as bypass mode does.
  • That same change fixed browser_batch "Permission denied" errors after a redirect.
  • The fixes landed in Claude Code 2.1.275, part of a near-daily cadence of permission and credential-leak patches through September 2026.

Plugin Credential Leak Closed

Anthropic fixed plugin and marketplace messages, logs and claude plugin marketplace list showing a password or token stored in a git, ssh or marketplace URL, and separately fixed the VS Code extension's Manage plugins dialog showing a password or token that was typed into a marketplace URL. Anyone who had put a credential directly into a plugin source URL previously had that secret visible anywhere those URLs were displayed or logged.

npm Install Scripts No Longer Run

Plugins installed from an npm source are now fetched with npm pack --ignore-scripts and integrity-verified, so a package's install scripts no longer run. That closes a supply-chain risk: installing a plugin from npm could previously trigger that package's own install scripts, which is exactly the mechanism attackers use to run arbitrary code the moment a package is pulled down.

Auto Mode's Chrome Behavior

Claude Code also changed Claude in Chrome in auto mode to skip the extension's per-site check for classifier-approved calls, as bypass mode does, which fixed browser_batch "Permission denied" errors appearing after a redirect.