diff --git a/tabby-plugin-manager/src/services/pluginManager.service.ts b/tabby-plugin-manager/src/services/pluginManager.service.ts
index b2e83f458..0d1f312e6 100644
--- a/tabby-plugin-manager/src/services/pluginManager.service.ts
+++ b/tabby-plugin-manager/src/services/pluginManager.service.ts
@@ -1,4 +1,4 @@
-import { compare as semverCompare } from 'semver'
+import { compare as semverCompare, valid as semverValid } from 'semver'
 import { Observable, from, forkJoin, map, of } from 'rxjs'
 import { Injectable, Inject } from '@angular/core'
 import { Logger, LogService, PlatformService, BOOTSTRAP_DATA, BootstrapData, PluginInfo } from 'tabby-core'
@@ -84,6 +84,12 @@ export class PluginManagerService {
     }
 
     async installPlugin (plugin: PluginInfo): Promise<void> {
+        if (!/^(tabby|terminus)-[a-zA-Z0-9._-]+$/.test(plugin.packageName) || PLUGIN_BLACKLIST.includes(plugin.packageName)) {
+            throw new Error(`Refusing to install disallowed package: ${plugin.packageName}`)
+        }
+        if (!semverValid(plugin.version)) {
+            throw new Error(`Refusing to install package with invalid version: ${plugin.version}`)
+        }
         try {
             await this.platform.installPlugin(plugin.packageName, plugin.version)
             this.installedPlugins = this.installedPlugins.filter(x => x.packageName !== plugin.packageName)