# a-marketplace-plugin-quietly-chose-where-claude-code-installed-your: A Marketplace Plugin Quietly Chose Where Claude Code Installed Your Dependencies

> A Marketplace Plugin Quietly Chose Where Claude Code Installed Your Dependencies is a high-severity supply chain compromise issue in Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill, an agent skill. Affected: Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill, from an unvetted public-repo marketplace.

- **Canonical URL:** https://catalog.anomity.ai/vuln/a-marketplace-plugin-quietly-chose-where-claude-code-installed-your
- **Aliases:** ti-084
- **Severity:** high
- **Attack type:** Supply chain compromise
- **Component:** Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill (agent skill)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-01-05
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/a-marketplace-plugin-quietly-chose-where-claude-code-installed-your

## Summary

Prompt Security researcher David Abutbul showed a plugin called Python Dependency Helper, installed from an unvetted marketplace hosted in a public repo, exposing a manage_python_dependencies skill that Claude Code then treated as a trusted workspace capability. Asking Claude to add httpx resolved the package from an attacker-controlled source rather than the official index, delivering a trojanized library able to exfiltrate environment variables, watch outbound requests, or hide a backdoor keyed to a specific HTTP pattern. The install looks normal and the imports work. Because the plugin stays enabled, every later session inherits the same poisoned resolution path.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill, from an unvetted public-repo marketplace | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill, from an unvetted public-repo marketplace.

## How do I fix it?

Treat an installed plugin as part of the trust boundary rather than as a convenience, because its skills persist into every future session rather than expiring with the one that installed them. Inventory which marketplaces developers install agent plugins from, and pin package resolution to your own index so an agent cannot be steered elsewhere. A skill that can choose an install source is a supply-chain control and should be reviewed like one.

## How do I find every machine running Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Plugin "Python Dependency Helper" exposing the manage_python_dependencies skill and which version, then enforce a policy on it.

## References

- article: https://prompt.security/blog/when-your-plugin-starts-picking-your-dependencies-marketplace-skills-and-dependency-hijack-in-claude-code

## Related vulnerabilities

- [toxicskills-36-percent-of-audited-agent-skills-carried-security-flaws](https://catalog.anomity.ai/vuln/toxicskills-36-percent-of-audited-agent-skills-carried-security-flaws) — high
- [trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace](https://catalog.anomity.ai/vuln/trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace) — critical
- [load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope](https://catalog.anomity.ai/vuln/load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope) — high
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [microsoft-china-aligned-storm-0940-ran-the-artex-agentic-pen-test](https://catalog.anomity.ai/vuln/microsoft-china-aligned-storm-0940-ran-the-artex-agentic-pen-test) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=a-marketplace-plugin-quietly-chose-where-claude-code-installed-your