Anthropic Claude Code Source Code Leaked: 512,000 Lines Accidentally Published on npm — What Developers Must Know

This is one of the most significant accidental source code leaks in AI history. Anthropic — the company behind Claude, valued at $380 billion — accidentally included a JavaScript source map file inside its Claude Code CLI tool's npm package. Source maps are debugging artifacts that reconstruct original source code from minified output. In a public npm package, they expose everything — architecture, internal logic, unreleased features, and trade secrets — to anyone who installs the package.

How It Happened — Technical Explanation

Anthropic published Claude Code version 2.1.88 to the npm registry on March 31, 2026. The package was minified as expected for a closed-source tool, but the build pipeline accidentally included a cli.js.map file — a 59.8 MB source map that completely reconstructs the original TypeScript source. Security researcher Chaofan Shou (@Fried_rice on X) spotted it at 8:23 AM UTC on March 31 and posted publicly. Within hours, thousands of developers had downloaded, mirrored, and analyzed the code.

• Package: @anthropic-ai/claude-code version 2.1.88
• What leaked: ~2,000 TypeScript files, 512,000 lines of source code (59.8 MB .map file)
• Discovery post views: 28.8 million on X
• GitHub mirror: 84,000+ stars, 82,000+ forks before takedown requests
• Anthropic response: Pulled package; issued 8,000+ takedown requests (later narrowed to 96)

What the Leaked Code Revealed

Developers who analyzed the code found remarkable details about how Claude Code actually operates internally:

• KAIROS background agent mode: Mentioned 150+ times — allows Claude Code to run as an always-on daemon, handling tasks autonomously while the user is idle, consolidating memory via "autoDream," and sending push notifications. Not yet publicly shipped.
• Internal model codenames: "Capybara" (Claude 4.6 variant), "Fennec" (Opus 4.6), "Numbat" (unreleased). Internal comments reveal a 29-30% false claims rate in Capybara v8.
• Undercover mode (undercover.ts): Instructs Claude Code to never mention internal codenames, Slack channels, or "Claude Code" itself when working in non-internal repositories. AI-authored commits have no indication an AI wrote them.
• Anti-distillation poisoning: Injects fake tool definitions into API responses if competitors attempt to scrape outputs to train their own models.
• 44 feature flags: For fully built but unreleased features — including 20 unshipped capabilities.
• 187 "spinner verbs": The phrases served while working through tasks, plus a regex filter detecting swear words in user prompts.

"The timing couldn't come at a worse time for Anthropic. Claude Code's run-rate revenue had reached $2.5 billion as of February. The source code exposure hands rivals a detailed map of design logic underlying a product they have been racing to replicate." — VentureBeat, April 1, 2026

The Separate Supply Chain Attack (Axios) — Urgent

Separately from the source code leak, a concurrent supply chain attack compromised the axios npm package (a Claude Code dependency). Developers who updated Claude Code on March 31, 2026 between 00:21 and 03:29 UTC may have pulled a malicious version containing a Remote Access Trojan.

Check now if you're affected: Look in your package-lock.json or yarn.lock for axios versions 1.14.1 or 0.30.4, or the dependency plain-crypto-js. If found: immediately downgrade and rotate all credentials.

What This Means For You

• Individual developers: No immediate security risk from the source code leak itself. The axios supply chain attack is the actionable concern.
• Enterprise Claude Code users: Audit any Claude Code activity from March 31. No API keys or customer data were in the source code leak.
• Competitors (OpenAI, Google): Now have architectural details of one of the most commercially successful AI coding tools.
• Security researchers: The leaked architecture reveals the exact orchestration logic — enabling more targeted attack research.

Anthropic confirmed: "No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We're rolling out measures to prevent this from happening again."