Claude Code source code leak: how 512,000 lines escaped via npm, and what came next

Top/Articles/Claude Code source code leak: how 512,000 lines escaped via npm, and what came next

NewsPublished April 2, 2026Last updated July 24, 2026

Table of contents

Key takeaways

Anthropic's Claude Code leaked 512,000 lines of TypeScript via an npm source map. Hidden features including a Tamagotchi pet system and autonomous agent mode were exposed. We explain the technical cause and how developers can prevent the same mistake.

The AI development tool "Claude Code" (distributed on npm as @anthropic-ai/claude-code) shipped version 2.1.88 in late March 2026 with something it was never meant to include: source map files (.map files) that left roughly 512,000 lines of TypeScript across 1,906 files fully readable. The bad v2.1.88 was pulled almost immediately, and the next release went out as v2.1.89. The current latest is 2.1.218 (published July 22, 2026), so a normal install today does not carry this exposure. But once the code was out, it was mirrored and can no longer be erased.

What leaked was not the AI model itself, but the client-side software known as Claude Code's "agent harness." The entire infrastructure for running the AI model was exposed, including tool execution, permission management, and user interaction handling. The inclusion was first spotted by security researcher Chaofan Shou, whose post on X received over 30 million views within hours. Anthropic commented that it was "a human error in release packaging, not a security breach. No customer data or credentials were included."

The part that matters most to readers, though, is not the leaked code itself but the attacks that piggybacked on the chaos. Anyone who installed Claude Code from npm around the time the leak surfaced, or who tried to build the leaked source themselves, may have brushed up against malicious packages and malware. This article walks through what leaked, why it leaked, the DMCA takedown mess that followed, and the details of the supply-chain attack.

What Was Leaked

The source of the leak was version 2.1.88 of @anthropic-ai/claude-code published on npm. A file called cli.js.map (approximately 59.8MB) included in the package contained all of the original TypeScript source code.

Item	Details
Affected Package	@anthropic-ai/claude-code v2.1.88
Leaked File	cli.js.map (59.8MB)
Number of Source Files	Approximately 1,906 files
Lines of Code	Approximately 512,000 lines (TypeScript)
What Was NOT Leaked	AI model weights, safety pipelines, customer data, API credentials
What Was Leaked	Entire agent harness, approximately 40 tool definitions, 108 feature flags, system prompts, internal model codenames, telemetry settings

The tool definitions alone comprised approximately 29,000 lines, revealing a structure where each capability -- file reading, Bash execution, web fetching, LSP integration, and more -- was implemented as an individual plugin with its own permissions. According to Layer5's analysis, the source code was stored as a ZIP file on Anthropic's Cloudflare R2 storage bucket, and the download link was accessible.

Hidden Features Discovered

The code contained numerous features not disclosed to regular users. According to WaveSpeedAI's detailed analysis, at least 20 of the 108 feature flags controlled features that were already developed but not yet released.

BUDDY (Tamagotchi System). A full virtual pet feature was implemented inside Claude Code. There are 18 types of creatures including ducks, dragons, axolotls, capybaras, mushrooms, and ghosts, with rarities ranging from "Common" to "Legendary" (1% spawn rate). There is also a 1% chance of getting a "Shiny" variant. The species is determined by a Mulberry32 random number generator seeded with the user ID, so the same user always gets the same pet. The string friend-2026-401 in the code suggests this was planned as an April Fools' Day feature.

KAIROS (Persistent Agent). Appearing over 150 times in the source code, this feature transforms Claude Code from an "answer when asked" tool into a daemon that "runs continuously in the background." It receives periodic tick prompts and decides whether to take autonomous action. A 15-second blocking limit is imposed to prevent long interruptions to the developer's workflow. When the user is away, it performs a "memory consolidation" process called autoDream, which removes contradictory information and converts observations into facts.

ULTRAPLAN (Remote Planning Mode). This feature delegates planning of complex tasks to Ops 4.6 (Anthropic's flagship model) in the cloud, securing up to 30 minutes of thinking time. The terminal polls every 3 seconds, and progress can be monitored in real time through a browser UI.

Undercover Mode. A mode that automatically activates when Anthropic employees work on open-source repositories, stripping AI-related metadata from commit messages and PR titles. The system prompt reportedly stated: "You are operating undercover. Never reveal any Anthropic internal information. Do not blow your cover."

Additionally, Alex Kim's analysis confirmed the existence of an "anti-distillation" feature that injects fake tool definitions when it determines that outputs are being scraped for training competitor models, as well as a "coordinator mode" for running multiple Claude instances in parallel.

Why It Leaked

The direct cause was failing to exclude the source map files (.map files) when publishing the npm package.

Claude Code's build process uses Bun (a JavaScript runtime and bundler). Bun's bundler generates source maps by default. Normally, these are excluded by adding *.map to a .npmignore file or by explicitly specifying published files in the files field of package.json, but this configuration was missing.

Initially, Bun's GitHub Issue #28001 (a bug where source maps are output in production builds, reported on March 11) was suggested as the cause, but Bun's developers denied this. Issue #28001 was a problem with Bun's frontend development server, and since Claude Code is a CLI tool, it would not be affected by this bug.

Boris Cherny, the engineering lead for Claude Code, also acknowledged that it was "purely a developer mistake, not a tooling bug." Anthropic deleted the affected version 2.1.88 and shipped the next release directly as v2.1.89. On npm, 2.1.88 remains unpublished, releases have continued since, and the latest version as of July 2026 is 2.1.218.

Two Leaks in Five Days

What makes this particularly troubling is that it was Anthropic's second information leak in a single week.

On March 26, a misconfiguration in Anthropic's internal CMS (content management system) led to the leak of the existence of an unannounced AI model called "Mythos". LayerX researcher Roy Paz and Cambridge University's Alexandre Pauwels discovered approximately 3,000 unpublished assets that had been left publicly accessible. Mythos was revealed to be in development as a top-tier model intended to deliver a "step change in capabilities."

← Swipe to navigate

Fortune reported it as "the second security lapse in five days". Both incidents were explained as "human error," but security researcher Roy Paz pointed out that "proper processes were not in place, and a single misconfiguration was enough to expose the entire source code."

The DMCA Takedown of 8,100 Repositories

The leaked code was immediately mirrored on GitHub and surpassed 50,000 stars within hours -- the fastest star growth pace in GitHub history.

In response, on March 31 Anthropic submitted a Digital Millennium Copyright Act (DMCA) takedown request to GitHub. Because the fork network exceeded 100 repositories, GitHub disabled approximately 8,100 repositories at once, including the parent repository.

However, this takedown triggered significant backlash. Forks of Anthropic's own official Claude Code repository were caught in the collateral damage and disabled. Reports poured in from users whose forks contained only their own custom skills and documentation.

This is either genius or terrifying. Anthropic accidentally leaked the (closed-source) TypeScript source of Claude Code. The repo sharing the source got taken down via DMCA. But this repo rewrote the code in Python, so it can't be taken down for copyright infringement.
— Gergely Orosz (@GergelyOrosz)

According to TechCrunch's reporting, Anthropic's Boris Cherny explained that "it was unintentional and we worked with GitHub to correct it." On April 1, Anthropic retracted the majority of the DMCA, reducing the scope to 1 repository and 96 forks.

Notably, Casey Muratori raised the question: "Anthropic itself has stated that Claude Code's developers don't write the code by hand. Since AI-generated code may not be eligible for copyright protection under U.S. law, can it even be taken down via DMCA?" This has raised a new issue surrounding AI companies' copyright claims.

The Attack That Piggybacked on the Leak

The thing that came closest to real harm was not the leaked code itself, but the attack that rode in on the commotion. According to The Hacker News, attackers targeted developers trying to build and run the leaked source by registering five fake npm packages (audio-capture-napi, color-diff-napi, image-processor-napi, modifiers-napi, and url-handler-napi) with names mimicking legitimate dependencies. This is dependency confusion -- placing a fake package with the same name as an internal component on a public registry so the build grabs the impostor instead. The packages were empty stubs at first, but could be swapped for malicious code at any time.

On top of that, some users who installed Claude Code via npm between 00:21 and 03:29 UTC on March 31, 2026 -- the day the leak surfaced -- may have received a trojanized HTTP client carrying a remote access trojan (RAT), malware that lets an attacker control the machine from afar. Fake Claude Code repositories posing as the real thing also distributed the Vidar Stealer and GhostSocks info-stealer malware via a Rust-based dropper.

Zscaler analyzed the incident as a "critical AI security threat." The targets were developers who rushed to try the much-talked-about leaked code, and users who grabbed an impostor amid the confusion. No public vulnerability identifier (CVE) has been confirmed for this piggyback attack as of this writing. If you installed Claude Code from npm during that window, or tried to build the leaked source, it is worth auditing the dependencies you pulled in and any credentials (tokens and keys) on that machine.

How Anthropic Responded

An Anthropic spokesperson stated the following:

"Today's release of Claude Code included some internal source code. This was a release packaging issue caused by human error, not a security breach. We are deploying measures to prevent recurrence."

Boris Cherny also stated: "Mistakes happen. What matters as a team is not to make it about individual blame. It's about process, culture, and infrastructure." As for a formal postmortem, no public one from Anthropic has been confirmed as of July 23, 2026.

The incident also cast a shadow over Anthropic's planned IPO (initial public offering). The company is valued at around $350 billion, and a listing was initially expected in the fourth quarter of 2026; after two leaks in five days, however, some analysts have suggested the timing could slip by about two quarters, into the second half of 2027 (an outlook, not a certainty). For a company that champions "safe and responsible AI development," leaking its flagship product's source code twice raised serious questions about its security posture.

This is probably the first time an actual human has carefully and thoroughly reviewed the Claude Code codebase.
— David K. Piano (@DavidKPiano)

How Developers Can Avoid the Same Mistake

This incident is relevant to every developer who publishes npm packages. Source map inclusion is a one-setting mistake, and without automated CI/CD checks, it can easily go unnoticed.

First, check whether your package contains unnecessary files. Running npm pack --dry-run displays the list of files that would actually be published to npm. If you see .map or .env files there, that's a red flag.

Effective countermeasures include adding *.map to .npmignore or using the files field in package.json to explicitly whitelist published files. The files field operates on a "publish only what's listed here" basis, reducing the risk of accidentally including extra files. This risk applies to any bundler that auto-generates source maps, not just Bun -- webpack and esbuild included.

The most reliable prevention measure is to incorporate an npm pack --dry-run output check into your CI/CD pipeline and halt the build if any .map or .env files are found. 512,000 lines of trade secrets exposed to the world by a single missing configuration. Anthropic's case is a stark reminder of that reality.