Key Takeaways:<\/p>\n
Anthropic leaked the source code for Claude Code CLI tool through an unobfuscated source map file in the latest NPM package.
\nThe leak contained more than 512,000 lines of TypeScript code, it shows internal system prompts, secret APIs, and the core logic of their agentic architecture.
\nWhile the core AI model weights and user data remain safe, this is the second time Anthropic faced a packaging oversight in a year.<\/p>\n
Security researcher Chaofan Shou reported that the latest version of Claude Code (v2.1.88) on the NPM registry contained an exposed source map file. According to the official report ,this 60MB file allowed anyone to reconstruct the original, human readable source code from the production version. This incident shared more than 1,900 files of Anthropic\u2019s proprietary logic with the entire world.<\/p>\n
Claude code source code has been leaked via a map file in their npm registry!
\nCode: https:\/\/t.co\/jBiMoOzt8G pic.twitter.com\/rYo5hbvEj8
\n\u2014 Chaofan Shou (@Fried_rice) March 31, 2026<\/p>\n
The Anatomy of a Source Map Failure
\nIn software development, source maps are meant for debugging and should never be included in a public release. Anthropic allowed the developer community to archive the entire repository on GitHub, where it received thousands of good reviews in a few hours. This is an example of a packaging oversight, where a company moves so fast in the AI race that basic security protocols are missed. For developers using CLI tools, this shows how fragile the connection between a local machine and a cloud based AI service is.
\nAnthropic accidentally leaks Claude Code source code
\nWhat Was Exposed in the 500,000 Lines
\nThe leaked code provides a look into the brain of an AI agent. It includes the hidden system prompts that controls Claude\u2019s behavior, the architecture for agentic functions, and unreleased internal APIs. The leak exposed the communication protocols between processes and the encryption tools used to secure the tool\u2019s operations. The exposure of these internal recipes allows companies to study Anthropic\u2019s methods for managing coding tasks and file system interactions while user data is not at risk.
\nIt is the second leak for Anthropic in the last year. It suggests a weakness in the software release pipeline. The tools developers trust most can become the biggest failure if not managed with precision.
\nRead Next: CZ Warns About Supply Chain Attacks After Security Leak\u00a0
\nLessons for the AI Developer Community
\nThe failure from this leak will be felt for months as hackers and researchers continue to analyze the logic behind Claude Code. It is a sign to strengthen CI\/CD pipelines and ensure that metadata is stripped from every public package.
\nRead Next: Bybit Launched AI Hub to Let Users Trade Crypto Using AIs like ChatGPT, Claude, and Gemini <\/p>\n","protected":false},"excerpt":{"rendered":"