Claude Code Source Code Leaked via npm Source Map: 1,900 Files, 512,000+ Lines Exposed

The Claude Code source leak sent shockwaves through the developer community on March 31, 2026, when security researcher Chaofan Shou discovered that Anthropic’s flagship agentic CLI tool had its entire proprietary codebase accidentally exposed through a source map file published to the public npm registry. The leaked codebase — spanning nearly 1,900 TypeScript files and over 512,000 lines of code — was rapidly archived to a public GitHub repository, surpassing 1,100 stars and 1,900 forks within hours of discovery.

What Is Claude Code?

Claude Code is Anthropic’s official command-line interface (CLI) that lets developers interact with artificial intelligence models directly from their terminal for software engineering tasks. It functions as an AI pair programmer capable of editing files, running shell commands, searching codebases, and managing Git workflows — all through natural language instructions. Far from a simple chat wrapper, the leaked source reveals a deeply engineered, production-grade system built on Bun (not Node.js), using React with Ink for terminal UI rendering, and Zod v4 for schema validation across tool inputs, API responses, and config files.

How the Claude Code Source Leak Happened

The root cause was a misconfigured build pipeline that accidentally included a .map source map file in the published npm package. Source maps are debugging tools that map minified JavaScript back to the original, human-readable source code. When included in a production npm package, they effectively ship the entire original codebase in readable form to anyone who downloads the package. This was not the first incident — earlier in 2025, versions v0.2.8 and v0.2.28 were also accidentally shipped with full source maps. Anthropic quickly removed those versions, but cached copies remained accessible. One developer even recovered the source map using Sublime Text’s undo history after Anthropic wiped the cached npm files. For more on cybersecurity risks in software supply chains, this incident is a textbook case study.

“A single misconfigured .npmignore or files field in package.json can expose an entire proprietary codebase to the public.”

Gabriel Anhaia, Developer & Security Analyst, dev.to

What the Leaked Source Code Reveals

The codebase offers a rare, detailed look at how a frontier AI coding tool is architected at scale. The tool system alone comprises approximately 40 built-in, permission-gated tools — including Read, Write, Edit, Bash, Grep, WebFetch, and Agent — with the base tool definition spanning 29,000 lines of TypeScript. The query engine, at 46,000 lines, handles all LLM API calls, streaming, caching, and orchestration. Multi-agent orchestration allows Claude Code to spawn sub-agents (internally called “swarms”) to handle complex, parallelizable tasks. A bidirectional IDE bridge connects VS Code and JetBrains extensions via JWT-authenticated channels, and a file-based persistent memory system stores user context across sessions. The source also revealed quirky easter eggs: a random array of loading messages including “Clauding,” “Vibing,” and “Honking,” plus a hidden /stickers tool that lets users request Anthropic swag by mail. Developers examining the code on Hacker News also noted approximately 50 slash commands, lazy-loaded modules for heavy dependencies, and some code quality concerns including repeated ad-hoc hash function implementations and extensive use of process.argv throughout the codebase.

Anthropic’s Response

Upon discovering the Claude Code source leak, Anthropic rapidly pushed an update to remove the source map from the published package and unpublished the affected versions from the npm registry. However, the code had already been mirrored, forked, and archived across GitHub before the takedown. Whether Anthropic pursues legal action against those hosting mirrors remains to be seen, but the architectural patterns — tool systems, permission gates, multi-agent spawning — are now part of the public discourse on how to build agentic AI applications.

Key Lessons for Every Engineering Team

This incident is a critical reminder for any team publishing npm packages. First, run npm pack --dry-run before every release to verify exactly what files are being published. Second, source maps are source code — never include .map files in production packages unless intentional. Third, audit your .npmignore and package.json files field carefully. Fourth, react quickly — Anthropic’s fast response reduced further spread, but could not undo what was already cached. Fifth, assume public once published: npm packages, once live, can be downloaded globally within seconds. The incident also inadvertently reveals just how high the engineering bar is for production AI coding tools in 2026 — industrial-grade permission systems, multi-agent orchestration, IDE integrations, and persistent memory far beyond what most assumed was under the hood.

All source code referenced in this article is the intellectual property of Anthropic, PBC. This article is published for informational and educational purposes only.