Claude Code 2.1.275 stops running the install scripts inside a plugin from npm

Installing a package normally means running whatever its author put in the install scripts, which is the oldest hole in every package ecosystem. As of the release Anthropic published on September 17, 2026, a Claude Code plugin from npm is fetched with npm pack --ignore-scripts and integrity-verified, so those scripts do not run at all. Nothing about how you install a plugin changes; what changes is that the plugin no longer gets to execute code on your machine before you have used it once.

The plugin channel treated as a supply chain

Two changes in this release point the same way. The install-script change removes the execution step from the install path entirely, and integrity verification means the bytes that arrive are the bytes that were published. Alongside it, plugin and marketplace messages, logs and claude plugin marketplace list no longer print a password or token that was stored in a git, ssh or marketplace URL. The VS Code Manage plugins dialog had the same problem with a token typed into a marketplace address, and it was fixed too.

A credential printed into a log is not a dramatic failure at the moment it happens, which is exactly why it is worth fixing. Logs get pasted into issues, shared in chat and collected by telemetry, and the token is still valid in all of those places. Read together, the two changes treat the plugin channel as a supply chain rather than as a convenience.

Three fixes that were reporting the wrong thing

The worst of them is quiet. On Linux, a sandboxed Bash command running under zsh reported exit code 0 even when the command had failed, so anything that branches on the exit status was branching on a lie. A rewind in a forked or background session could restore a file that was zero-filled or truncated, when the session's file-history backups could not be fully copied, which turns a recovery step into a loss. And /update-config was writing Write(path) permission rules, which the file permission checks do not match, instead of the Edit(path) rules that they do.

• A failed sandboxed command on Linux under zsh no longer reports success.
• A rewind that cannot copy the full file history now fails instead of restoring a damaged file.
• Permission rules written by the configuration command now use the form the checks actually match.

What else arrived, and what broke for a day

Skills and plugins enabled on a claude.ai account now sync to terminal sessions signed in with that account, with a separate opt-out for each through syncClaudeAiSkills and syncClaudeAiPlugins. A send-now key interrupts the current turn and sends every queued message at once, and queued and sent messages are shown in gray until the model receives them.

• The release also broke something: every request failed with HTTP 400 and an input-tag error for anyone whose ANTHROPIC_BASE_URL points at a proxy or gateway.
• 2.1.276, published the next day, contains that single fix and nothing else.
• Teams behind a gateway should therefore treat 2.1.275 as a version to skip rather than one to roll back to.