The Medusa plugin catalog marks some plugins with a Verified badge. A plugin gets the badge when it passes all four groups of checks on this page, covering security, compatibility with the latest Medusa release, maintenance and documentation.
To see only these plugins, turn on the Verified filter in the catalog. The plugin page shows the plugin version, the Medusa release and the check date next to the badge, and the catalog list shows them when you hover over the badge.
What We Check
Security
No install scripts – the published package has no , or script of its own.
No known vulnerabilities – the plugin's own dependencies, apart from Medusa packages, have no known vulnerabilities rated high or critical.
No malware reports – the OSV database has no malicious-package report for the plugin or its dependencies.
No secrets in the package – the published archive has no files, key files or bundled , and none of its files contains a private key or a common API token.
No obfuscation – the published JavaScript shows no signs of obfuscation.
Compatibility
Medusa version ranges – the version ranges the plugin declares for Medusa core packages admit the latest Medusa release.
Clean install – the plugin installs into a new Medusa project on the latest release without or .
Build – succeeds, including Medusa Admin with the plugin's admin extensions.
Migrations – succeeds and, when the plugin ships migrations, creates its tables.
Startup – the server starts, responds with , and the startup log has no errors.
Maintenance
Public repository – the source code is in a public GitHub repository that is not archived, and the npm package is not deprecated.
Recent release – the latest version was published no more than 180 days ago.
Up to date with Medusa – the plugin was built against a Medusa release no more than four months older than the latest one, or its version ranges admit the latest release and it installs on that release without errors.
Tests in CI – the repository has test files and a CI workflow that runs them.
Open-source license – declares an OSI-approved license.
Documentation
Setup instructions – the README shows how to install the plugin and register it in .
English – the README is written mostly in English.
Environment variables – the README lists every environment variable the plugin reads.
How We Check Plugins
We read the package as npm publishes it, along with its public repository. To check compatibility, we install the plugin into a new Medusa project on the latest release with a PostgreSQL database, then build the project, run the migrations and start the server.
We use placeholder values instead of real API keys. That is enough to confirm that the plugin loads and starts, but not to test whether a payment goes through or a provider receives an order.
Our own plugins go through the same checks as every other plugin in the catalog. The Maintenance page describes how we test and update them.
What the Verified Badge Means
The Verified badge confirms that a specific plugin version passed these checks on a specific Medusa release. It is not an endorsement or a guarantee from us, so make sure a plugin fits your store before you use it in production.
The security checks look for known risks in the published package. They are not an audit of the plugin's code.
A missing badge is not a warning. A plugin without it may work well and still fail one of the checks on this page.
For Plugin Authors
You don't need to apply. A plugin listed in the catalog gets the badge if it passes every check on this page. These steps help a plugin pass:
Keep the peer dependency ranges open to new minor releases instead of pinning an exact version.
Host the public repository on GitHub, where we read the repository status.
Describe the install command, the registration and every environment variable in the README.
If your plugin meets the criteria but has no badge, or you disagree with a result, write to the Telegram support chat or open an issue in the medusa-integrations repository on GitHub.