Claude Code Source Map Leak (March 31, 2026): A Deep-Dive Into What Happened, What Was Exposed, and What It Means

"Security is hard. But .npmignore is harder, apparently." — GitHub user Kuberwastaken, in a post-leak repository README

---

📌 Table of Contents

1. Executive Summary
2. Timeline of Events
3. Technical Background: What is a Source Map?
4. How the Leak Happened
5. What Was Actually Inside the Leaked Codebase?
6. Hidden Features and Internal Architecture Revealed
7. The Concurrent Axios Supply Chain Attack
8. The "Undercover Mode" Irony
9. This Was Not the First Time
10. Anthropic's Response
11. Strategic and Competitive Implications
12. Secondary Fallout: Typosquatting and Dependency Confusion
13. Claims vs. Reality: Fact Check
14. Best Practices: Lessons for Developers and AI Companies
15. Final Verdict

---

Executive Summary

On March 31, 2026, one of the most significant accidental source code exposures in recent AI history unfolded. Anthropic — the AI safety company behind the Claude family of models — accidentally shipped the complete internal TypeScript source code of its flagship developer tool, Claude Code CLI, inside a publicly accessible npm package.

The exposure was caused by a single misconfigured build artifact: a 59.8 MB JavaScript source map file (.map) that was inadvertently bundled into version 2.1.88 of the @anthropic-ai/claude-code npm package. This file contained a pointer to a publicly accessible zip archive hosted on Anthropic's own Cloudflare R2 storage bucket — meaning anyone who knew where to look could download the entire codebase without any hacking whatsoever.

Within hours of its discovery by security researcher Chaofan Shou, the ~512,000-line TypeScript codebase was mirrored across GitHub and analyzed by thousands of developers worldwide. Anthropic confirmed the incident and attributed it to human error in the release packaging process.

The event was not a hack, not a breach, and exposed no user data or model weights. But it was a significant intellectual property exposure that handed competitors a detailed architectural blueprint of one of the most sophisticated AI coding tools ever built.

---

Timeline of Events

Note: Five days earlier, on March 26, a CMS misconfiguration at Anthropic had separately exposed ~3,000 internal files containing details about an unreleased model called "Claude Mythos" — marking two significant accidental disclosures in under a week.

---

Technical Background: What is a Source Map?

To understand why this leak was so severe, it's essential to first understand JavaScript source maps.

The Problem Source Maps Solve

When you write modern JavaScript or TypeScript, you typically use a build toolchain (like tsc, esbuild, bun, webpack, or rollup) to:

1. Compile TypeScript → JavaScript
2. Bundle many files into one or a few output files
3. Minify the output (removing whitespace, shortening variable names) to reduce file size

The result is often a single, nearly unreadable bundle file like:

// Minified production output
function a(b){return b.map(c=>c*2)}const d=a([1,2,3]);

This is great for performance, but terrible for debugging. If this code throws an error in production, the stack trace says something like line 1, column 48293 — completely meaningless.

What Source Maps Do

A source map (.js.map file) is a JSON file that acts as a Rosetta Stone between minified code and the original source. It maps every character in the minified output back to its exact location in the original TypeScript files.

Debuggers (like Chrome DevTools or VS Code's debugger) use source maps automatically in development to show you the real, human-readable source when an error occurs.

Why Source Maps Should Never Be Public

If a source map is accessible publicly:

• Anyone can reverse-engineer the original TypeScript from the minified bundle
• Internal file paths, module names, and directory structure are revealed
• Business logic, feature flags, and architectural decisions become readable
• Proprietary algorithms and orchestration systems are exposed

In Anthropic's case, the source map didn't just point to a few files — it pointed to a hosted zip archive on Cloudflare R2 containing the complete, human-readable source of ~1,900 TypeScript files.

---

How the Leak Happened

The Build Toolchain: Bun

Claude Code uses Bun as its JavaScript runtime and build tool. Bun generates source maps by default unless explicitly disabled. This is a developer experience feature — great for development, dangerous for production npm publishing.

The failure likely occurred at one of these points:

1. Missing .npmignore rule — The team forgot to add *.map to their .npmignore file, so npm pack included the .map file alongside the published package
2. Build configuration oversight — Source map generation was not explicitly turned off for production builds with a flag like --sourcemap=none
3. CI/CD gap — No automated pre-publish audit checked for the presence of .map files in the artifact

The resulting @anthropic-ai/claude-code@2.1.88 package was 59.8 MB larger than it should have been — a red flag that, had automated size checks been in place, could have triggered an alert.

From Source Map to Full Source Code

The source map file didn't just contain the source inline — it contained a URL pointing to a zip archive on Anthropic's own Cloudflare R2 storage bucket. That bucket was publicly accessible. So the attack path was:

npm install @anthropic-ai/claude-code@2.1.88
  → Unpack .map file
    → Find Cloudflare R2 URL in .map file
      → Download public zip archive
        → Extract ~1,900 TypeScript files, 512,000+ lines

No credentials. No hacking. Just a web request.

---

What Was Actually Inside the Leaked Codebase?

The leaked archive contained approximately 1,900 TypeScript files and over 512,000 lines of code. Here's what developers found inside:

Scale and Structure

Major Modules

1. The Tool System (~40 Tools)

Claude Code uses a plugin-like tool architecture. Each capability — file read, bash execution, web fetch, LSP integration, browser interaction — is a discrete, permission-gated "tool." The base tool definition alone spans 29,000 lines of TypeScript.

Tools include:

• FileReadTool — reads files with smart chunking
• BashTool — executes shell commands with sandboxing
• WebFetchTool — fetches and parses web content
• LSPTool — integrates with Language Server Protocol for IDE-like code intelligence
• GlobTool, GrepTool — fast codebase search
• TodoTool — manages task lists within sessions
• AgentTool — spawns sub-agents for parallelism

2. The Query Engine (46,000 Lines)

The largest single module. It handles:

• All LLM API calls to the Anthropic backend
• Streaming responses
• Token-level caching
• Multi-turn conversation management
• Orchestration logic between tools and the model

3. Multi-Agent Orchestration

The source reveals a sophisticated system for spawning and managing parallel sub-agents. Claude Code isn't a single Claude instance — it's a framework for coordinating multiple AI instances simultaneously, delegating subtasks and aggregating results.

4. The React Terminal Renderer

Perhaps the most surprising discovery: Claude Code's terminal UI is built with a custom React renderer targeting the terminal rather than the DOM. This explains the smooth, interactive TUI (Terminal User Interface) experience — it's built the same way web UIs are built, just rendered in your terminal.

5. IDE Integration Bridges

The codebase contains bridges for deep integration with:

• VS Code (via the Language Server Protocol)
• JetBrains IDEs
• Generic LSP-compatible editors

---

Hidden Features and Internal Architecture Revealed

This is where the leak gets particularly fascinating. The source code exposed several systems that were never documented publicly.

🧠 KAIROS: The Always-On Background Agent

The word "KAIROS" (from Ancient Greek, meaning "the right moment") appears over 150 times in the source code. It represents what may be the most significant unreleased feature exposed by the leak:

An autonomous daemon mode for Claude Code.

Current AI tools are reactive — they respond when you ask. KAIROS would allow Claude Code to operate as an always-on background agent with features including:

• Background sessions that run while the user is idle
• autoDream mode — during idle periods, the agent performs memory consolidation: merging observations, resolving contradictions, and converting vague notes into concrete facts
• Cron-style scheduling — running tasks at predetermined times without user initiation

🧩 Three-Layer "Self-Healing Memory" Architecture

One of the most technically impressive discoveries was Claude Code's memory system, designed to solve context entropy — the degradation of AI performance as sessions grow longer:

Layer 1: MEMORY.md — The Index A lightweight, always-loaded file containing ~150-character-per-line pointers to other files. It doesn't store data; it stores locations of data. Always present in context.

Layer 2: Topic Files — Distributed Knowledge Actual project knowledge is stored in separate topic-specific files and fetched on-demand rather than pre-loaded. This keeps the active context lean.

Layer 3: Transcripts — Never Fully Read Raw session transcripts are never fully loaded back into context. Instead, they are grep'd for specific identifiers when needed. This prevents context pollution from irrelevant history.

Strict Write Discipline: The agent can only update its memory index after a confirmed successful file write, preventing hallucinated memory states.

🐾 Tamagotchi Companion System ("Friend System")

Perhaps the most delightful surprise: Claude Code has an internal virtual pet system (codename: "Friend" or "Tamagotchi") that assigns each user a persistent animal companion.

• Your "buddy species" is deterministically generated from your userId hash using a Mulberry32 PRNG seeded with the salt 'friend-2026-401'
• Species names are obfuscated via String.fromCharCode() arrays to prevent them from appearing in string searches
• There is a 1% "shiny" chance for any companion, independent of rarity (rarest: Shiny Legendary Nebulynx at 0.01% probability)
• Companions are rendered as 5-line-tall, 12-character-wide ASCII art with multiple animation frames

🎭 "Undercover Mode" — The System Designed to Prevent Exactly This

In a deeply ironic twist, the leaked code includes a subsystem called "Undercover Mode" — specifically built to prevent Anthropic's internal codenames and architecture details from leaking via Claude Code's own outputs (e.g., git commits, code comments).

The system instructs the AI to avoid writing internal project codenames into user-visible artifacts. Anthropic built a whole subsystem to prevent the AI from leaking internal details — then shipped the entire source in a .map file.

🐦 Codenames and Internal Culture

The codebase reveals a rich internal culture at Anthropic:

• Animal codenames for internal projects: Tengu, Fennec, Capybara
• Playful feature names: Penguin Mode, Dream System
• The Tamagotchi system itself suggests the team deliberately built in delight and personality for users they expected to use the tool heavily

🚩 Feature Flags and Unreleased Capabilities

Viral reports claimed 44 hidden feature flags were exposed. While that specific number couldn't be independently verified at time of writing, the source confirms the presence of a feature flag system controlling:

• Voice input capabilities
• Extended background agent modes
• Experimental IDE integration features
• The KAIROS daemon system

---

The Concurrent Axios Supply Chain Attack

Independently of the source code leak, a separate and more immediately dangerous security incident occurred on the same day.

Between 00:21 and 03:29 UTC on March 31, 2026, the axios npm package — one of the most widely used HTTP client libraries in the JavaScript ecosystem — was the subject of a supply chain attack. Malicious versions 1.14.1 and 0.30.4 were briefly published to npm, containing a cross-platform Remote Access Trojan (RAT) via a dependency called plain-crypto-js.

Since Claude Code depends on axios, any developer who ran npm install or updated Claude Code via npm during this 3-hour window may have installed the trojaned version.

Immediate Actions Required If You Installed During That Window

1. Check your lockfiles (package-lock.json, yarn.lock, bun.lockb) for axios@1.14.1, axios@0.30.4, or plain-crypto-js
2. Downgrade axios to a verified safe version immediately
3. Rotate all credentials and secrets that may have been accessible from the affected machine
4. Audit your system for signs of unauthorized access

Anthropic subsequently recommended using its native installer over npm to reduce supply chain exposure going forward.

---

The "Undercover Mode" Irony

It bears repeating as its own section, because the irony is so rich:

Anthropic engineers built Undercover Mode — a deliberate system within Claude Code's AI prompting logic — specifically to ensure that when Claude Code writes code, commits messages, or generates output for users, it would not accidentally embed Anthropic's internal codenames, architectural details, or strategic plans into user-visible artifacts.

They were worried about the AI leaking internal information through its outputs.

They were not worried about the build system shipping the full source code to npm.

The system designed to protect internal information was itself exposed by the very packaging process it was trying to compensate for. This is not a criticism so much as a perfect illustration of how security gaps often exist in unexpected places — the sophisticated threat model was correct, but the mundane operational detail (.npmignore) was the actual vulnerability.

---

This Was Not the First Time

This is critically important context: this was the second time this exact mistake happened.

A nearly identical source map leak occurred with an earlier version of Claude Code in February 2025 — approximately 13 months before the March 2026 incident.

This means:

• The February 2025 incident did not result in permanent, systemic process changes that prevented recurrence
• The same class of packaging misconfiguration was possible 13 months after it was first exploited
• Either the remediation after the first incident was incomplete, or new infrastructure/processes introduced in the interim reintroduced the same gap

Additionally, just five days before this incident (March 26, 2026), a separate CMS misconfiguration at Anthropic exposed approximately 3,000 internal files, including details about the unreleased "Claude Mythos" model, which Anthropic subsequently confirmed as their most capable model to date.

Two major accidental disclosures in five days, and a recurrence of a class of vulnerability from 13 months prior — these are the facts that most sharpen industry scrutiny of Anthropic's internal release discipline.

---

Anthropic's Response

Anthropic's official statement, shared with both VentureBeat and CNBC:

"No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We're rolling out measures to prevent this from happening again."

The company also:

• Pulled version 2.1.88 from npm immediately
• Issued DMCA takedown requests against GitHub mirrors (with mixed success — mirrors and archived copies remain accessible)
• Recommended the native installer over npm for Claude Code going forward
• Did not publish a broader public post-mortem or technical write-up

Notably, Anthropic has not published a detailed post-mortem explaining exactly what went wrong, what checks were in place, or the specific remediation measures being implemented. Given this is the second recurrence of the same class of issue, a detailed technical post-mortem would be a reasonable industry expectation.

---

Strategic and Competitive Implications

For Anthropic — a company with a reported $19 billion annualized revenue run-rate as of March 2026 — this leak represents more than an embarrassing mistake. It is a strategic hemorrhage of intellectual property.

What Competitors Now Know

1. The Memory Architecture — The three-layer MEMORY.md system for solving context entropy is now public. Competitors can implement a similar approach.

2. The Tool System Design — The permission-gated, plugin-style tool architecture is now documented in 512,000 lines of TypeScript.

3. The Multi-Agent Orchestration Logic — How Claude Code spawns, manages, and coordinates parallel agents is now visible.

4. The KAIROS Roadmap — Competitors now know that autonomous background agents with idle-time memory consolidation are an active development priority at Anthropic.

5. The Security Guardrails — Most concerning from a security perspective: the leak reveals the exact orchestration logic for Hooks and MCP servers, which could allow attackers to design malicious repositories specifically crafted to bypass permission prompts or trigger unintended background commands.

The Race Dynamics

This leak occurs in the context of an extremely competitive AI coding assistant market. Tools like GitHub Copilot, Cursor, Windsurf, Aider, and others are competing aggressively. Having one's architectural blueprint exposed is an asymmetric competitive disadvantage — the code is public now, but the institutional knowledge, engineering team, and continued iteration remain Anthropic's.

---

Secondary Fallout: Typosquatting and Dependency Confusion

In the hours and days following the leak, attackers moved quickly to exploit it through typosquatting and dependency confusion attacks.

The Attack Vector

The leaked source code revealed the names of internal npm packages that Anthropic uses as dependencies but that are not publicly published. Attackers, knowing that developers might try to build Claude Code from source using the leaked code, published empty stub packages to npm under those same internal package names — all published by a user identified as "pacifier136".

Security researcher Clément Dumas explained the mechanism:

"Right now they're empty stubs (module.exports = {}), but that's how these attacks work — squat the name, wait for downloads, then push a malicious update that hits everyone who installed it."

What This Means

Any developer who:

1. Downloaded the leaked Claude Code source code
2. Ran npm install to resolve its dependencies
3. Pulled in one of these typosquatted packages

...could be exposed to a future malicious payload pushed by the attacker. The packages appear benign today; the attack is staged for later.

Mitigation: Only install Claude Code from official channels. Do not attempt to build from leaked source.

---

Claims vs. Reality: Fact Check

Given the viral spread of this story, it's worth distinguishing verified facts from unverified claims:

---

Best Practices: Lessons for Developers and AI Companies

For Individual Developers Publishing to npm

1. Always Audit Your Package Before Publishing

# Dry-run to see exactly what will be published
npm pack --dry-run

# Or pack it and inspect the tarball
npm pack
tar -tvf your-package-1.0.0.tgz

Check for any .map, .env, or other unexpected files.

2. Configure .npmignore Explicitly

# .npmignore
*.map
*.map.js
**/*.js.map
**/*.ts.map
.env
.env.*
src/
tests/
*.test.ts
internal/

Note: .npmignore overrides .gitignore for npm. If you don't have .npmignore, npm falls back to .gitignore — but be explicit.

3. Disable Source Maps in Production Builds

With Bun:

bun build ./src/index.ts --outdir ./dist --sourcemap=none

With esbuild:

esbuild src/index.ts --bundle --sourcemap=false --outfile=dist/index.js

With webpack:

// webpack.config.js
module.exports = {
  devtool: false, // No source maps in production
  mode: 'production',
}

4. Add a Pre-Publish CI Check

# .github/workflows/pre-publish.yml
- name: Check for source maps in package
  run: |
    npm pack --dry-run 2>&1 | grep -E '\.map$' && \
    echo "ERROR: Source map files found in package!" && exit 1 || \
    echo "No source maps found. Safe to publish."

5. Use files in package.json Instead of .npmignore

The allowlist approach is safer than the denylist approach:

{
  "name": "my-package",
  "files": [
    "dist/",
    "README.md",
    "LICENSE"
  ]
}

With files, only the listed paths are published. Anything not listed is excluded by default — the opposite of .npmignore's denylist model.

6. Monitor Package Size

# Install bundlephobia CLI or check size after packing
ls -lh *.tgz

A sudden size increase (like 59.8 MB when you expect ~2 MB) is an immediate red flag.

For AI Companies and High-Value Publishers

1. Treat Published Artifacts as Adversarial Inputs

Assume a sophisticated attacker will inspect every file in your published package. Run automated scans for source maps, internal configs, API keys, and other sensitive artifacts before every release.

2. Implement Mandatory Pre-Publish Gate in CI/CD

No one person should be able to publish to npm without passing an automated check. Require:

• Size delta approval (alert if package grows by >X%)
• Forbidden file extension scan (.map, .env, internal config extensions)
• Secrets scanner (detect API key patterns)

3. Use a "Four Eyes" Review for Production Releases

Two-person review is standard in security-critical software. For a company managing a tool used by millions of developers and running on machines with broad filesystem access, this is a reasonable requirement.

4. Treat Source Code as Intellectual Property, Not Just Code

Especially for agentic AI tools where the architecture is the product, the source code contains your competitive moat, your roadmap, and your security model. Protect it accordingly.

5. Post Detailed Post-Mortems

When a failure like this occurs, a detailed public post-mortem does several things:

• Builds trust with users and the developer community
• Documents exactly what failed, preventing internal recurrence
• Signals industry-wide norms for transparency
• Helps other companies avoid the same mistake

Anthropic's single-sentence response, while legally cautious, leaves much to be desired from a transparency standpoint — particularly given this is the second occurrence.

6. Separate Internal Package Namespaces

Use internal npm registry (like Verdaccio, GitHub Packages, or Artifactory) for internal dependencies rather than relying on unpublished public package names. This eliminates the dependency confusion attack surface entirely.

---

Final Verdict

---

Closing Thoughts

The Claude Code leak is a perfect case study in how the most sophisticated technology can be undone by the most mundane operational slip. Anthropic built a 512,000-line, multi-agent, self-healing-memory AI coding system — sophisticated enough that its own internal anti-leak subsystem (Undercover Mode) guards against the AI inadvertently revealing internal details.

And then the build system shipped the whole thing to npm.

The lesson is not that Anthropic is careless. The lesson is that security hygiene is a continuous, systems-level discipline — not a one-time checklist. In the race to ship AI tools faster than competitors, every link in the delivery chain matters: the code, the build system, the CI/CD pipeline, the packaging configuration, the publishing process, and the human who clicks "publish."

When one link fails — even the least glamorous one — the consequences scale to the entire user base and the global developer community.

---

This article is written for educational and informational purposes. All proprietary code referenced remains the intellectual property of Anthropic. No reproduction of leaked code is included or endorsed.

---

Sources:

• The Hacker News — "Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms"
• VentureBeat — "Claude Code's source code appears to have leaked: here's what we know"
• DEV Community — "Claude Code's Entire Source Code Was Just Leaked via npm Source Maps — Here's What's Inside"
• Bitcoin News — "Anthropic Source Code Leak 2026: Claude Code CLI Exposed via npm Source Map Error"
• GitHub: Kuberwastaken/claude-code — Community analysis repository
• Heise Online — "Claude Code unintentionally open source: Source map reveals all"
• SOCRadar — "Claude Code Leak: What You Need to Know"