On March 31, 2026, Anthropic confirmed that the complete source code of its Claude Code CLI was accidentally exposed due to a packaging error during the npm release process. The incident made approximately 512,000 lines of TypeScript code publicly accessible — no hacking required.
Root Cause: Bun Builder's Source Map Default
The leak originated from version 2.1.88 of the npm package @anthropic-ai/claude-code. A 59.8 MB JavaScript source map file — a debugging artifact that maps minified production code back to original TypeScript — was included in the package. This source map pointed directly to a publicly accessible ZIP archive stored in Anthropic's own Cloudflare R2 bucket. Security researcher Chaofan Shou, an intern at blockchain security firm Fuzzland, discovered the issue and shared the direct bucket link on X. Within hours, mirror repositories appeared on GitHub, some accruing tens of thousands of stars before Anthropic issued DMCA takedown notices.
The underlying cause was straightforward: the Bun build tool generates source maps by default, and no build step excluded or disabled this debugging artifact before publication. A simple entry in .npmignore or the files field in package.json would have prevented the leak.
What Was Leaked: ~1,900 TypeScript Files and Hidden Features
The exposed source code covers Claude Code CLI's core implementation: tool execution logic, permission architecture, memory system, telemetry, system prompts, and feature flags. It also reveals several previously unannounced hidden features:
- KAIROS: An always-on background daemon that monitors files, logs events, and runs a memory consolidation process called 'dreaming' during idle periods.
- BUDDY: A terminal pet with 18 species (including capybara) and attributes such as DEBUGGING, PATIENCE, and CHAOS.
- COORDINATOR MODE: Allows a single agent to spawn and manage parallel worker agents.
- ULTRAPLAN: Schedules remote multi-agent planning sessions lasting 10–30 minutes.
The telemetry system scans prompts for profanity as a frustration signal but does not log complete user conversations or code. An 'incognito mode' instructs the AI to remove internal codenames and project details from git commits and pull requests.
Not the First Time
Anthropic told VentureBeat that the incident was 'a release packaging problem caused by human error' and that steps are being taken to prevent recurrence. However, this marks the second identical leak in 13 months — an early version of Claude Code suffered an almost identical source map exposure in February 2025. Just five days prior (March 26), Anthropic also leaked roughly 3,000 internal documents — including details of an unreleased 'Claude Mythos' model — due to a CMS misconfiguration. Two major accidental leaks within a week have raised questions about the company's release discipline, especially as its tools are widely used for writing and deploying code at scale.
Additional Risks and Security Advice
The March 31 incident coincided with a separate npm supply-chain attack against the axios package (active between 00:21 and 03:29 UTC). Anthropic recommends that developers who installed or updated Claude Code via npm during that window review dependencies and rotate credentials. The company also suggests using its native installer over npm going forward. While no user data or model weights were compromised, the blueprint for building a Claude Code competitor is now far easier to obtain. As of this writing, Anthropic has not released a more detailed postmortem.