AI Plugin Checkout SHA Verification Mismatch Check

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•4

Detects a git checkout to a specific SHA followed by a git rev-parse HEAD verification command within AI coding assistant plugin directories (e.g., claude, codex, copilot, gemini). This pattern is monitored to identify potential supply chain compromises where a working tree might be silently substituted during plugin installation or updates.