Product
Claude Code and Claude Desktop failed to verify the integrity of git checkouts during plugin installation, allowing attackers to substitute pinned commits with malicious code via branch name collision.