npm-source plugin install/update fails on npm 12 with `EALLOWREMOTE`: the installer runs `npm pack <tarball URL>` instead of `name@version`

What happens

With npm 12 installed, installing or updating any plugin whose marketplace entry uses an npm source fails:

✘ Failed to install plugin "ai-tc@akasecurity": Could not download @akasecurity/ai-tc-claude-code@0.9.14 from the npm registry: code EALLOWREMOTE

npm 12 defaults allow-remote (and allow-git) to none, which refuses to fetch a package spec that is a remote tarball URL. Claude Code resolves the tarball URL itself and then packs by URL. With a PATH shim logging npm's argv, the installer runs:

npm view --json -- @akasecurity/ai-tc-claude-code@0.9.14 name version dist.tarball dist.integrity dist.shasum dist-tags.latest
npm pack --ignore-scripts --loglevel=error -- https://registry.npmjs.org/@akasecurity/ai-tc-claude-code/-/ai-tc-claude-code-0.9.14.tgz

The same package fetched as a registry spec works under npm 12's defaults:

| Command (npm 12.1.0, default config, no npmrc) | Result |
|---|---|
| npm install --ignore-scripts @akasecurity/ai-tc-claude-code@0.9.14 | ✅ exit 0 |
| npm pack --ignore-scripts @akasecurity/ai-tc-claude-code@0.9.14 | ✅ |
| npm pack --ignore-scripts -- https://registry.npmjs.org/@akasecurity/ai-tc-claude-code/-/ai-tc-claude-code-0.9.14.tgz | ❌ EALLOWREMOTE "Fetching packages of type "remote" have been disabled" |
| same, with npm_config_allow_remote=all | ✅ |

Repro

1. npm 12.x with default config: npm config get allow-remote prints none.
2. claude plugin marketplace add akasecurity/marketplace
3. claude plugin install ai-tc@akasecurity, which fails with EALLOWREMOTE. claude plugin update … fails the same way.

Expected

npm-source plugins install on current npm without weakening its defaults. For example, run npm pack <name>@<version> (registry spec) and verify the tarball against the dist.integrity already fetched by npm view, rather than packing the resolved URL.

Workaround

Use a per-command override, which leaves npm's global default alone:
npm_config_allow_remote=all claude plugin install <plugin>@<marketplace>.

Environment

Claude Code 2.1.284, npm 12.1.0, Node v26.10.0, macOS 27.0.