Claude Code Source Code Leaked via npm Source Maps:…

Key Takeaways

Security researcher Chaofan Shou discovered Anthropic's entire Claude Code CLI source code exposed through a .map file shipped in the @anthropic-ai/claude-code npm package on March 31, 2026.
The leak exposed approximately 1,900 TypeScript files and 512,000+ lines of code, including internal API logic, OAuth flows, multi-agent orchestration systems, and unreleased feature flags.
The source code was hosted on Anthropic's own R2 cloud storage and was directly downloadable as a ZIP archive—a critical misconfiguration in their build pipeline.
This is the second known source map exposure for Anthropic, following a similar incident reportedly patched in early 2025.
The incident underscores the importance of auditing npm publish configurations and build pipelines to prevent accidental intellectual property exposure.

The Discovery

On March 31, 2026, security researcher Chaofan Shou (@shoucccc on X) publicly disclosed that Anthropic's Claude Code—their flagship agentic CLI tool for developers—had its entire source code inadvertently exposed through the npm registry.

The @anthropic-ai/claude-code npm package contained a source map (.map) file that referenced the complete, unminified TypeScript source code. The source files were hosted on Anthropic's own Cloudflare R2 storage bucket and were directly downloadable as a ZIP archive. Within hours, the codebase had been mirrored to multiple public GitHub repositories, accumulating over 1,100 stars and 1,900 forks.

What Are Source Maps and Why Are They Dangerous?

Source map files (.map) are standard developer tools designed to map compiled, bundled, or minified JavaScript back to its original source code for debugging purposes. They are essential during development but should never be included in production npm packages.

When a source map is accidentally bundled into a published package, it effectively bypasses all code obfuscation and minification—exposing the complete original source to anyone who examines the package contents. This is equivalent to shipping your private repository alongside your production build.

What Was Exposed

The leaked codebase represents the entirety of Claude Code's src/ directory. The scope of the exposure is substantial:

Scale and Architecture

~1,900 TypeScript files totaling 512,000+ lines of code
Built on the Bun runtime (not Node.js), leveraging its dead code elimination and faster startup times
Terminal UI built with React + Ink (React for terminals), making the CLI component-based with full state management
Zod v4 used extensively for schema validation across all tool inputs, API responses, and configuration files

Core Systems Revealed

QueryEngine.ts (~46,000 lines): The core LLM API engine handling streaming, tool execution loops, caching, token tracking, and model orchestration
Tool.ts (~29,000 lines): Defines all ~40 agent tool types including BashTool, FileReadTool, FileEditTool, WebFetchTool, and AgentTool for sub-agent spawning, each with discrete permission gates
commands.ts (~25,000 lines): Registers and executes ~50 slash commands spanning Git workflows, code review, memory management, and multi-agent orchestration

Sensitive Internal Details

OAuth 2.0 authentication flows and internal API client logic
Multi-agent orchestration systems (internally called "swarms") for parallelized task execution
IDE bridge system: A bidirectional, JWT-authenticated communication layer connecting VS Code and JetBrains extensions to the CLI
Persistent memory system: File-based context storage for user preferences and project state across sessions
Unreleased feature flags: PROACTIVE, VOICE_MODE, BRIDGE_MODE, and KAIROS—indicating features not yet publicly available

A Repeat Incident

This is notably not the first time Anthropic has experienced a source map exposure. Reports indicate a similar incident was patched in early 2025. Additionally, just days before this leak on March 26, 2026, Fortune reported that Anthropic had left details of an unreleased AI model and an invite-only CEO retreat in an unsecured database—suggesting a pattern of operational security gaps.

These repeated incidents raise questions about Anthropic's internal security review processes, particularly around their build and deployment pipelines for developer-facing tools.

The Broader Supply Chain Implications

While this leak is primarily an intellectual property concern for Anthropic, it carries significant supply chain security implications for the broader developer ecosystem:

Attack Surface Expansion

Exposed internal API endpoints, authentication flows, and permission logic provide a roadmap for potential exploitation
Knowledge of internal tool architectures could enable more targeted prompt injection or tool manipulation attacks
The exposed multi-agent coordination protocol could be reverse-engineered to intercept or manipulate agent-to-agent communication

Precedent for AI Tool Security

This incident comes alongside other Claude Code security concerns. In February 2026, Check Point Research disclosed CVE-2025-59536 and CVE-2026-21852—vulnerabilities enabling remote code execution and API key exfiltration through Claude Code project files. Combined with this source code exposure, the security posture of AI-powered development tools is under increasing scrutiny.

Remediation and Recommendations

Whether you use Claude Code or any npm-published tool, this incident provides actionable lessons:

For Development Teams Publishing npm Packages

Audit your .npmignore and package.json files field: Ensure .map files, source directories, and internal build artifacts are explicitly excluded from published packages
Run npm pack --dry-run before every publish to inspect exactly which files will be included
Implement CI/CD checks that automatically reject packages containing source maps or unexpected file types
Use npm publish --dry-run as an additional safeguard in your release pipeline

For Organizations Using AI Coding Tools

Monitor vendor security advisories and patch cycles for all AI-powered development tools in your stack
Review tool permissions: Understand what filesystem, network, and system access your AI coding assistants have
Audit third-party package integrity using tools like FYEO's Third-Party Library Scanner to identify supply chain risks before they reach production
Avoid third-party mirrors of leaked source code—they may contain modified or malicious payloads

FYEO's Perspective

At FYEO, we audit the security of software supply chains across Web3 and enterprise environments. This incident exemplifies exactly the kind of build pipeline vulnerability that automated scanning alone cannot catch. Source map inclusion, credential exposure in cloud storage, and repeated security oversights require a hybrid approach—combining automated tooling with expert human review.

Our security audit services examine not just application code, but the entire CI/CD pipeline, package management configuration, and deployment processes that can silently expose proprietary systems to the public.

Claude Code Source Code Leaked via npm Source Maps: What You Need to Know