Plugin-Security

A developer investigating unexpected behavior from a Vercel plugin installed alongside Claude Code has uncovered what appears to be undisclosed data collection — including bash command strings and session-level data — occurring in projects that have nothing to do with Vercel. The findings, reported by TechRadar, were themselves discovered using Claude as an investigation tool, creating a notable meta-story: Claude was used to expose privacy concerns in a plugin bundled with Claude Code. ...

After a developer recently used Claude itself to discover that a Vercel plugin bundled with Claude Code was collecting bash commands and session data beyond its stated scope, the question of plugin supply-chain safety has moved from theoretical to immediate. This checklist gives you a practical process for auditing what your Claude Code plugins are actually doing. Related news: Claude Code’s Vercel Plugin Quietly Collected Bash Commands — A Developer Used Claude to Expose It ...