TLDR Tech / InfoSec
Repo-jacking Anthropic's Claude Community Plugins (And the SHAs That Saved Them)
Stawinski agent-scanned Anthropic's official claude-plugins-community marketplace.json for entries pointing at owner/repo paths whose GitHub accounts had been renamed or deleted, then claimed one dangling namespace (oduffy-delphi), recreated deep-research-claude seeded with a clone of the real project, and demonstrated that the /plugin install flow's "Open Homepage" action lands the user on the attacker-controlled repo with no warning, one click from a setup-mode user who already trusts the ecosystem. The automated code-install path held because marketplace entries pin each source to an immutable commit SHA (e76d372e96e626f01a8d3a6c2aed142faa1234d4 for this plugin), so a recreated repo cannot reproduce the pinned hash and the integrity check fails, though the author flags that Anthropic's bot-driven SHA-refresh PRs may be foolable into ingesting a SHA from a malicious commit, making the protection durable only until that validation is bypassed. Anthropic closed the report as out-of-scope (dependency hijacking excluded, residual risk classed as social engineering). IOCs are the dangling paths still claimable at disclosure time: mailfnguides-del/Claude-Paste, comment-io/claude-code-plugin, CharlieGreenman/ghostlty-dynamic-themes, Chipkorvyn/Strategy-consultant, and oduffy-delphi/deep-research-claude. Harden by treating Anthropic-vetted marketplaces as untrusted third-party code, pinning all plugin sources to commit SHAs rather than branch refs, auditing marketplace.json for owner paths whose accounts no longer resolve, and avoiding "Open Homepage" on freshly installed plugins since that link resolves live and outside any SHA guarantee.
Read the full story