Anthropic accidentally published Claude Code's full source code to npm
What happened
A packaging mistake shipped a complete source map inside a public Claude Code release on npm, exposing about 512,000 lines of the agent's code, including its permission system and unreleased features. Anthropic confirmed it was human error; the code was mirrored widely within hours.
Version 2.1.88 of the Claude Code package on npm shipped with a 59.8 MB source map, a debugging file that links compiled code back to the original. This one pointed to a zip archive on Anthropic's cloud storage that anyone could download without logging in, containing about 1,900 TypeScript files and more than 512,000 lines of code for the command-line tool. Security researcher Chaofan Shou spotted it early on 31 March, and within hours the code was mirrored on GitHub and picked apart by thousands of developers. It revealed 44 flags for unreleased features, including a background agent called KAIROS, multi-agent orchestration and browser control, along with internal model code names. The Hacker News reported the likely cause was a known bug in the Bun runtime, which Claude Code is built on, that includes source maps in production builds. The leak covered the client software only, not model weights, training data or customer information.
How it happened
Leaky AI product: Accidental publication. A product feature, share link or software release made private data public by mistake.
The AI involved was from Anthropic. The product was Claude Code, a type of coding assistant.
Impact
Data was exposed. Data involved: source code. The impact was confined to one organization and its users or customers.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 31 Mar 2026.
Anthropic confirmed the leak, said no customer data or credentials were exposed and that it was a packaging mistake caused by human error rather than a breach, removed the affected version from npm and said it was adding safeguards. Copyright takedown requests it sent afterwards briefly hit thousands of GitHub repositories.