Anthropic Exposed Claude Code Source via npm Package Source Map

Anthropic accidentally exposed the source code of its Claude Code CLI after publishing npm package version 2.1.88 with a large JavaScript source map that pointed to unobfuscated TypeScript files hosted in company-controlled storage. Researcher Chaofan Shou identified the issue, which exposed roughly 1,900 to 2,000 files and more than 512,000 lines of code before the package was removed. Anthropic said the incident was caused by a manual release-packaging error rather than an external intrusion, and stated that no customer data or credentials were leaked. The code was quickly mirrored and forked on GitHub, making containment difficult, while Anthropic later acknowledged that automation gaps in its deployment process contributed to the exposure.

Analysis of the leaked code revealed internal architecture and unreleased capabilities including KAIROS background autonomy, persistent memory features, multi-agent orchestration, hidden feature flags, undocumented commands, and controls intended to resist model distillation or disclosure of internal names. Security researchers warned that exposing Claude Code’s permission logic, trust boundaries, prompts, and execution pathways could help attackers craft jailbreaks, prompt-injection lures, malicious repositories, and persistence techniques against the tool. Anthropic’s response also drew scrutiny after a DMCA notice led GitHub to disable thousands of legitimate forks before the company asked for narrower enforcement, and the leak’s impact was compounded by reports of typosquatted npm packages and a separate compromised axios dependency affecting some npm installs during the same period.