Anthropic Leaks Claude Code Source via NPM Misconfig

Anthropic, the AI company behind the Claude language models, accidentally exposed the full source code of its Claude Code tool on March 31, 2026, through a misconfigured file published to the npm registry. The incident, first identified by software engineer Chaofan Shou, provided developers with an unintended glimpse into the inner workings of the command-line coding assistant, sparking widespread analysis and raising security concerns.

The leak occurred when a source map file bundled with Claude Code version 2.1.88 was made public on npm, containing approximately 512,000 lines of TypeScript code across 1,906 files, totaling nearly 60 megabytes. Source maps, typically used for debugging, mapped the minified code back to its original, readable form, effectively revealing the entire client-side codebase. The material quickly spread across platforms like X and GitHub, where developers archived and examined it, amassing over 1,100 stars and 1,900 forks in a public repository within hours.

Among the disclosures were details on Claude Code's architecture designed to maintain accuracy during extended coding sessions. A three-layer memory system relies on a lightweight MEMORY.md file...