Anthropic has confirmed that a release packaging error caused the source code of its Claude Code CLI to become publicly accessible through npm. According to the report, version 2.1.88 of @anthropic-ai/claude-code shipped with a 59.8 MB JavaScript source map, which in turn pointed to a publicly reachable ZIP archive stored in the company’s own Cloudflare R2 bucket. As a result, roughly 512,000 lines of TypeScript code were exposed without the need for hacking or unauthorized system access.
A Publishing Mistake, Not a Conventional Breach
Anthropic told VentureBeat that the incident was caused by human error in the release packaging process rather than by an external intrusion. The source map, typically intended as a debugging aid for mapping bundled production code back to its original TypeScript files, was apparently left in the distributed package. The report says the issue could likely have been prevented if the build pipeline had excluded source maps or if package controls such as .npmignore or the files field in package.json had been configured properly.
The problem was identified by Chaofan Shou, a Fuzzland intern and security researcher, who posted the direct storage link on X. Within hours, mirrored repositories had appeared on GitHub. Some reportedly gathered substantial attention before Anthropic issued DMCA takedown notices. The speed of redistribution highlighted a familiar reality of software leaks: once source artifacts become public, removing the original file does not fully contain the spread.
What the Leak Revealed About Claude Code
Developers examining the exposed archive found around 1,900 TypeScript files covering a broad cross-section of the product’s internal design. The code reportedly included execution logic, permission structures, memory systems, telemetry components, system prompts, and feature flags. Collectively, these files provided a rare look into how Anthropic appears to build and operate a production-grade AI coding assistant.
One of the more discussed revelations involved telemetry behavior. According to the report, the telemetry system checks prompts for profanity as a signal of user frustration, but it does not log full user conversations or source code. Another reported feature, described as a form of stealth mode, instructs the AI to avoid references to internal codenames and project details in Git commits and pull requests.
The leak also surfaced a number of features that had not yet been publicly released. Among them was KAIROS, described as an always-on background daemon that monitors files, records events, and runs a memory consolidation process called “dreaming” while idle. Another feature, BUDDY, appeared to be a terminal pet system with 18 species, including a capybara, and attributes such as debugging, patience, and chaos. The report also referenced Coordinator Mode, which would allow a single agent to create and manage parallel worker agents, and Ultraplan, a feature for remote multi-agent planning sessions lasting roughly 10 to 30 minutes.
No Customer Data or Model Weights, but Competitive Insight Was Exposed
Anthropic said the incident did not expose sensitive customer data, credentials, model weights, or inference infrastructure. That distinction matters. From a direct user-risk perspective, the company’s statement suggests that the most serious categories of operational and customer information remained protected. However, the publication of internal application logic and hidden feature architecture still carries significant implications.
For developers, researchers, and competitors, leaked source code can provide a detailed blueprint of product strategy and engineering tradeoffs. Even without model weights, exposed implementation details can accelerate reverse engineering, imitation, or “clean room” rewrites. The report notes that some community members had already begun extracting telemetry logic, toggling hidden features, and creating alternative reconstructions in languages such as Python and Rust in an effort to avoid copyright complications.
This makes the event notable not because it compromised the Claude model itself, but because it lowered the barrier to understanding how Anthropic’s coding assistant is structured at the application layer. In practical terms, the leak may make it easier for others to build similar tooling or benchmark their own agentic developer products against Anthropic’s design choices.
A Repeat Incident Raises Questions About Release Discipline
One of the most troubling elements in the report is that this was not the first time such a mistake had occurred. A nearly identical source map exposure reportedly affected an earlier version of Claude Code in February 2025. Repetition changes how incidents are judged: what might be written off once as an isolated publishing oversight becomes, when repeated, a sign of insufficient release controls or weak process enforcement.
The timing adds further scrutiny. Just five days earlier, on March 26, Anthropic was also reported to have leaked roughly 3,000 internal documents because of a CMS configuration error. Those files allegedly included information related to an unreleased “Claude Mythos” model. Taken together, two disclosure incidents in less than a week inevitably raise questions about internal governance, deployment hygiene, and the safeguards used around sensitive software and documentation.
Additional Supply-Chain Concerns for npm Users
The report also noted that the Claude Code incident occurred on the same day as a separate npm supply-chain attack involving the axios package, active between 00:21 and 03:29 UTC. While the two events were described as distinct, the overlap is relevant for developers who installed or updated Claude Code through npm during that window. The recommendation in the report was to review dependencies carefully and rotate credentials as a precaution.
Anthropic has reportedly advised developers to prefer its native installer over npm going forward. That recommendation reflects a broader lesson from software distribution security: package registries are highly convenient, but they also add another layer of exposure if release artifacts are misconfigured or if the ecosystem is simultaneously dealing with supply-chain threats.
Why the Incident Matters Beyond Anthropic
This episode is a reminder that major AI companies are not only model providers; they are also software vendors shipping tools through mainstream developer channels. That means their operational risk increasingly resembles the risk profile of modern software firms: build systems, packaging defaults, storage permissions, and CI/CD policies can become just as consequential as model safety and inference security.
In this case, the leak did not appear to harm end users directly in the way a credential compromise or customer database breach might. But it still exposed valuable intellectual property and internal product direction. It also demonstrated how quickly developer communities can archive and analyze released artifacts once they become public, whether intentionally or not.
Anthropic has said it is taking steps to prevent a recurrence, but as of the report, the company had not issued a fuller public postmortem beyond its comment to VentureBeat. Until more detail is provided, the story stands as both a high-profile engineering lapse and a cautionary example of how seemingly minor packaging defaults can lead to major source code exposure.