Cc-plugin-audit: Defensive supply-chain security analysis on plugin auto-update