Skip to content

Supply-chain security · News

Oct 13 · Tuesday

Supply-chain security · News

Latest publications and developments
Oct 1Thu
  1. Claude, dev.to · 3 sourcesClaude · 3 sources · 3 reports · 43

    Anthropic launches TypeScript mods for Claude Code

    Anthropic has launched a mods system for Claude Code, allowing developers to use TypeScript or JavaScript functions to hook into events such as tool calls, user prompts, and UI rendering, rewriting prompts, adding or removing interface elements, or replacing built-in features. The built-in /diff has been changed to be implemented by a mod, and the feature is now available in the CLI and desktop app. Mods are distributed with plugins, run with user permissions, and are not sandboxed, having the same machine permissions as Claude Code; the official recommendation is to install only from trusted sources. Enterprises can control which mods are allowed to load; Team and Enterprise plans and machines configured with managed settings will load the sec-default mod first. Subsequent testing showed that on Claude Code 2.1.287, running the same prompt seven times in headless mode, one run loaded a seven-line plugin and a Bash(touch:*) deny rule simultaneously, and the file was created; the result JSON reported zero permission denials, and debug logs showed that the plugin returned allow and overrode the deny rule. The results were the same when the plugin was installed normally via claude plugin install.

    Latest developments
    1. Anthropic launches TypeScript mods for Claude Code

    2. Claude Code plugins can override user deny rules

Jan 15Thu
You have reached the end