Anthropic Accidentally Leaks Claude Code's Entire Source Code via NPM Source Maps
Boris ZarinskiAnthropic accidentally shipped source map files in their Claude Code npm package, exposing the full TypeScript source — 1,900 files, 512,000+ lines of code, unreleased feature flags, and the complete system prompt. Here's what happened and what the leak revealed.
What Happened
On March 31, 2026, Anthropic accidentally exposed the full source code of Claude Code — their flagship agentic CLI tool — through a packaging mistake in the npm registry. A .map file (source map) was included in the public npm package, allowing anyone to reconstruct the original TypeScript source code from the minified distribution.
The leak was discovered by security researcher Chaofan Shou and quickly spread across Hacker News, Twitter, and GitHub, where multiple repositories began archiving the extracted code.
How Source Maps Work
Source maps are files that map minified/bundled JavaScript back to the original source code. They're essential during development for debugging, but should never be shipped in production packages. When Anthropic published their npm package, they accidentally included the .map file, which contained a complete mapping back to every original TypeScript file.
Anyone could then run a source map extractor and recover the full, readable source — roughly 1,900 files and 512,000+ lines of code.
What the Leak Revealed
The exposed source code gave the public an unprecedented look into how Claude Code actually works under the hood:
- Tool System Architecture — Every tool Claude Code can invoke (file read, write, bash, grep, etc.) is implemented as a self-contained module with its own input schema, permission model, and execution logic.
- Permission Model — The full implementation of how Claude Code decides what actions require user approval and which can run automatically.
- System Prompt — The complete system prompt that shapes Claude Code's behavior was exposed in full.
- Unreleased Feature Flags — Several flags hinting at upcoming features were found in the code, including:
VOICE_MODE— voice interaction capabilitiesDAEMON— background agent modeBRIDGE_MODE— cross-instance communicationAGENT_TRIGGERS— scheduled autonomous agentsKAIROS— purpose unknownMONITOR_TOOL— observability tooling
Packaging Mistake, Not a Hack
This was not a security breach or hack. It was a build configuration error — the source map file should have been excluded from the npm publish step. Anthropic has since pushed an update to remove the source maps from the package.
That said, the damage is done. The code has been archived across multiple GitHub repositories and discussed extensively on Hacker News and social media. You can't un-ring this bell.
What This Means for Developers
For the developer community, this is both a cautionary tale and a learning opportunity:
- Always check your
.npmignoreorfilesfield inpackage.json— make sure source maps, test files, and internal documentation don't ship with your package. - Use
npm pack --dry-runbefore publishing to see exactly what files will be included. - CI/CD pipelines should validate package contents — automated checks can catch accidental inclusions before they reach the registry.
The Bigger Picture
This incident comes during a rough week for Anthropic's security posture. Fortune also reported that Anthropic left details of an unreleased model and an exclusive CEO event in an unsecured public database. Two security lapses in one week is not a great look for a company positioning itself as the "safety-first" AI lab.
Ironically, Claude Code itself is a remarkably well-engineered piece of software. The leaked source reveals clean architecture, thoughtful permission design, and sophisticated tool orchestration. The engineering is impressive — the packaging, less so.
