Anthropic’s Claude Code source leaked via npm map file
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Anthropic confirmed that internal code for its Claude Code AI coding assistant was released due to a human‑error packaging issue, and that no sensitive customer data or credentials were exposed.
- The npm package version 2.1.88 contained a source map file that exposed nearly 2,000 TypeScript files and more than 512,000 lines of Claude Code, and it has since been removed from npm.
- Security researcher Chaofan Shou first flagged the leak on X, where the post gathered over 28.8 million views; the code is now hosted on a public GitHub repo with over 84,000 stars and 82,000 forks.
- The leaked code reveals internal components such as a self‑healing memory architecture, a tools system, a query engine, multi‑agent orchestration, a bidirectional communication layer, the KAIROS persistent background agent, a “dream” mode, an Undercover Mode for stealth contributions, and anti‑distillation attack defenses.
- AI security firm Straiker warned that the leak gives attackers a blueprint to study Claude Code’s four‑stage context‑management pipeline and craft payloads that survive compaction, potentially creating persistent backdoors.
- Users who installed Claude Code via npm on March 31, 2026 between 00:21 and 03:29 UTC may have received a trojanized HTTP client containing a cross‑platform remote‑access trojan; they are advised to downgrade to a safe version and rotate all secrets.
- Threat actors are typosquatting five npm package names (audio‑capture‑napi, color‑diff‑napi, image‑processor‑napi, modifiers‑napi, url‑handler‑napi) to target developers compiling the leaked source, and Zscaler reports fake Claude Code repos distributing Vidar Stealer and GhostSocks malware.
Why it matters: Developers and enterprises using Claude Code now face heightened risk of malicious code execution, while Anthropic’s reputation and product security are jeopardized; the leak also supplies competitors with a detailed blueprint of the model’s architecture and triggers supply‑chain concerns, as users who updated the npm package on March 31 may have installed a trojanized HTTP client, prompting downgrades and secret rotation.
