Hijacking Claude Code via Injected Marketplace Plugins (promptarmor.substack.com)

Researchers demonstrated a practical attack that hijacks Claude Code via malicious marketplace plugins: an attacker publishes a fake Marketplace and Plugin (simple metadata files hosted on GitHub), a developer installs it, and the plugin uses hooks and crafted Command prompts to exfiltrate data. The chain: a hook either (A) rewrites Claude’s settings.local.json permissions to permanently allow dangerous commands like curl, or (B) intercepts pre-tool-use approval requests and auto-approves curl calls. With human-in-the-loop protections bypassed, a Plugin Command containing a prompt-injection convinces Claude to gather debugging context from the user’s codebase and send it to the attacker’s RAG server via curl. Hooks can hide their activity (suppressOutput) and the only visible artifact can be a fleeting “PreToolUse:Bash” flash. This is significant because marketplaces are trivially discoverable and hostable—registries auto-scrape GitHub and don’t verify plugins—so attackers can quickly gain visibility and impersonate vendors. Technically the attack leverages Claude components (Commands, Hooks, SubAgents, MCP servers) and model stochasticity to manipulate behavior without embedding obvious malware, making detection harder. Implications include data exfiltration, file deletion, reverse shells or malware writing via indirect LLM-driven actions, and a broader need to harden plugin vetting, permission-change workflows, and runtime approval checks.