Verify plugin commit pins after installing Claude Code plugins
A branch can pretend to be a commit SHA. Check what actually got checked out.
- Install pluginor update an existing one
- Find the code pulledthe checked out commit
- Find pinned SHAthe commit you approved
- Comparemust match exactly
- Act on mismatchremove and reinstall
Why it matters
A pinned SHA (the exact commit you approved) only helps if that commit is what runs. Git lets a branch use the same 40-character name, so checkout can silently land on an attacker's branch tip. Claude Code's plugin installer did not verify the checked out commit matched the pin (advisory (opens external site)); the flaw is fixed in 2.1.179 the plugin pinning flaw (opens external site).
Steps
- Update Claude Code to 2.1.179 or later. That release contains the fix.
- After each install, find the code the installer pulled and note the commit that is checked out.
- Find the SHA the marketplace pinned for that plugin. That is the commit you approved.
- Compare the two. If they differ, the plugin is not the code you reviewed.
- Remove the plugin and reinstall from a source you trust.
Common mistakes
- Assuming a 40-character name is always a commit. A branch can carry that name and point anywhere.
- Checking the marketplace page instead of the code on disk. The pin matters only if the installer pulled that commit.
- Assuming checkout always lands on the pinned commit. That is exactly the step the bug skipped.
Checklist
0 of 5 done