A purple-team exercise finds a malicious plugin silently overrides the clerk portal's benign summarizer. What ecosystem attack class is that?

Plugin shadowing is an ecosystem attack in which a malicious plugin substitutes for or overrides a trusted civic AI helper so callers still invoke a familiar name or entry point but execute attacker-controlled behavior. In a clerk portal purple-team finding, silent override of a benign summarizer means residents and staff may receive altered summaries, data leakage, or unauthorized actions while the UI still looks like the approved assistant. The correct classification centers on replacement under trusted identity within the plugin ecosystem—not on facilities aesthetics. Authorized assessments document the override path (load order, registry keys, package name collision, or capability registration), prove that signed allow-listed plugins would have blocked the impostor, and recommend continuous inventory of installed helpers on municipal workstations and portals.

Update hijacking where versioned refresh logic pulls a replacement summarizer from an attacker-controlled external feed source describes a different supply-chain vector, but the observed override was silent substitution of a plugin capability, not an attacker-controlled external feed replacing it during versioned refresh. Confused deputy behavior where a summarizer uses clerk portal privileges for external service calls describes a privilege misuse pattern, not the act of a look-alike plugin silently taking over a trusted summarizer name. Dependency confusion where a public package claims the private summarizer namespace during portal dependency resolution describes a namespace collision during dependency resolution, but the finding at hand is the active substitution itself, not a public package claiming a private namespace. Each distractor names a real but distinct supply-chain weakness, inviting candidates to confuse an adjacent control gap with the specific shadowing attack observed.

Exam caveat: shadowing can occur through lookalike package names, higher-priority registration, compromised update channels, or unsigned sideloading even when an official plugin remains installed—detecting both presence and active binding matters. Operational check: enumerate portal plugin registrations and hashes against the city allow list, attempt to install an unsigned override in a lab tenant, confirm signature verification rejects it, and verify the production summarizer endpoint still resolves only to the signed civic package after restart and redeploy.