Anthropic confirmed on March 31, 2026, that it accidentally shipped the complete source code of its Claude Code CLI inside a public npm package, exposing roughly 512,000 lines of TypeScript to anyone paying attention. Security researcher Chaofan Shou, an intern at blockchain security firm Fuzzland, spotted the issue and posted the direct bucket link on X. Within hours, mirrored repositories appeared on GitHub, some accumulating tens of thousands of stars before Anthropic's DMCA takedowns hit. Community members had already begun stripping telemetry, flipping hidden feature flags, and drafting clean-room reimplementations in Python and Rust to sidestep copyright concerns.
Inside the Leak: Unreleased Features and Full Architecture
The ~1,900 TypeScript files covered tool execution logic, permission schemas, memory systems, telemetry, system prompts, and feature flags — a full engineering view of how Anthropic builds a production-grade agentic coding tool. Telemetry scans prompts for profanity as a frustration signal but does not log full user conversations or code. An “undercover mode” instructs the AI to remove references to internal codenames and project details from git commits and pull requests.
Several unreleased features sat behind flags:
- KAIROS: an always-on background daemon that watches files, logs events, and runs a “dreaming” memory-consolidation process during idle time.
- BUDDY: a terminal pet with 18 species — including capybara — carrying stats like DEBUGGING, PATIENCE, and CHAOS.
- COORDINATOR MODE: lets a single agent spawn and manage parallel worker agents.
- ULTRAPLAN: schedules 10- to 30-minute remote multi-agent planning sessions.
Security and Industry Aftermath
Anthropic told Venture Beat the incident involved no sensitive customer data, no credentials, and no compromise of model weights or inference infrastructure. “This was a release packaging issue caused by human error,” the company said, adding that it is rolling out measures to prevent a repeat. However, this is the second time the same mistake has happened — a nearly identical source-map leak occurred with an earlier version of Claude Code in February 2025. Five days later, a CMS misconfiguration at Anthropic exposed roughly 3,000 internal files covering details on the unreleased “Claude Mythos” model. Two significant accidental disclosures in less than a week raises questions about release hygiene at a company whose tools are actively used to write and ship code at scale.
The March 31 incident also landed alongside a separate npm supply-chain attack on the axios package, active between 00:21 and 03:29 UTC. Developers who installed or updated Claude Code via npm during that window are advised to audit their dependencies and rotate credentials. Anthropic recommends its native installer over npm going forward.
Community Response and Crypto-AI Intersection
Despite Anthropic's DMCA takedowns, the leaked source code remains available in archived and mirrored forms. Community members have already stripped telemetry, enabled hidden features, and drafted clean-room reimplementations in Python and Rust. For the crypto and AI intersection, this event is seen as a reverse-engineering textbook — competitors now have a considerably easier blueprint to build a rival to Claude Code. Ethically, open-source advocates and security researchers are calling for stricter formal verification and automated checks in AI companies' release pipelines.
Anthropic has not published a broader post-mortem or public statement beyond its comment to Venture Beat. As investigations continue, the industry expects stricter npm publishing security standards to emerge.