{
  "entry": {
    "kind": "vuln",
    "slug": "a-marketplace-plugin-quietly-chose-where-claude-code-installed-your",
    "name": "a-marketplace-plugin-quietly-chose-where-claude-code-installed-your",
    "vendor": "Plugin \"Python Dependency Helper\" exposing the manage_python_dependencies skill",
    "description": "Prompt Security researcher David Abutbul showed a plugin called Python Dependency Helper, installed from an unvetted marketplace hosted in a public repo, exposing a manage_python_dependencies skill that Claude Code then treated as a trusted workspace capability. Asking Claude to add httpx resolved the package from an attacker-controlled source rather than the official index, delivering a trojanized library able to exfiltrate environment variables, watch outbound requests, or hide a backdoor keyed to a specific HTTP pattern. The install looks normal and the imports work. Because the plugin stays enabled, every later session inherits the same poisoned resolution path.",
    "website": "https://prompt.security/blog/when-your-plugin-starts-picking-your-dependencies-marketplace-skills-and-dependency-hijack-in-claude-code",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "skill",
    "updatedAt": "2026-01-05",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "a-marketplace-plugin-quietly-chose-where-claude-code-installed-your",
      "aliases": [
        "ti-084"
      ],
      "title": "A Marketplace Plugin Quietly Chose Where Claude Code Installed Your Dependencies",
      "summary": "Prompt Security researcher David Abutbul showed a plugin called Python Dependency Helper, installed from an unvetted marketplace hosted in a public repo, exposing a manage_python_dependencies skill that Claude Code then treated as a trusted workspace capability. Asking Claude to add httpx resolved the package from an attacker-controlled source rather than the official index, delivering a trojanized library able to exfiltrate environment variables, watch outbound requests, or hide a backdoor keyed to a specific HTTP pattern. The install looks normal and the imports work. Because the plugin stays enabled, every later session inherits the same poisoned resolution path.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise"
      ],
      "componentType": "skill",
      "component": {
        "name": "Plugin \"Python Dependency Helper\" exposing the manage_python_dependencies skill",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Plugin \"Python Dependency Helper\" exposing the manage_python_dependencies skill, from an unvetted public-repo marketplace",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-01-05",
      "modifiedAt": "2026-01-05",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://prompt.security/blog/when-your-plugin-starts-picking-your-dependencies-marketplace-skills-and-dependency-hijack-in-claude-code"
        }
      ],
      "mitigation": "Treat an installed plugin as part of the trust boundary rather than as a convenience, because its skills persist into every future session rather than expiring with the one that installed them. Inventory which marketplaces developers install agent plugins from, and pin package resolution to your own index so an agent cannot be steered elsewhere. A skill that can choose an install source is a supply-chain control and should be reviewed like one.",
      "detectedByAnomity": true
    }
  }
}