Anthropic Leaked 512,000 Lines of Claude Code via a Misconfigured npm Package

On March 31, 2026, security researcher Chaofan Shou noticed something odd inside the @anthropic-ai/claude-code npm package. There was a 59.8 MB debug file that pointed to a zip archive sitting in a public storage bucket owned by Anthropic. That archive contained the full Claude Code source code. 1,906 TypeScript files. 512,000 lines. Every tool, every slash command, and all the internal systems that make Claude Code work.

Anthropic confirmed it the same day. They called it “a release packaging issue caused by human error, not a security breach.” No customer data was exposed, no credentials, no model weights. But Claude Code's entire internal architecture was now public, including a system built specifically to stop exactly this kind of leak from happening. The GitHub mirror hit 41,500 forks before the end of the day.

“A single misconfigured .npmignore or files field in package.json can expose everything.” , Gabriel Anhaia, engineer

What makes this harder to swallow: it already happened once before. The same type of source map leak hit an earlier version of Claude Code in February 2025. Same mistake, same vector, thirteen months later.

How a Debug File Exposed an Entire Codebase

Source maps are debug helpers. When you compile and minify TypeScript for a release, source maps link the messy output back to your original code so you can read stack traces properly. They are useful during development. They should never ship to a public package.

In version 2.1.88 of @anthropic-ai/claude-code, a .map file was accidentally included in the npm tarball. That file had a URL pointing to a zip archive on Anthropic's Cloudflare R2 storage, which was publicly readable. So anyone who installed the package and opened the .map file could just download the whole source. No hack required.

No credentials were needed. Nothing was hacked. The source was just sitting there, openly accessible to anyone willing to peek inside a debug file.

What Was Inside

Once people had access, they found out Claude Code is built on Bun (not Node.js), uses React with Ink for the terminal UI, and has a multi-agent system internally called “swarms.” The four most significant things that became public:

No passwords leaked. No user data. But having the full source changes things for attackers. If you know exactly how Claude Code routes prompts, which tools it exposes, and what interface contracts those tools use, it is much easier to build targeted prompt injection attacks or find tool-abuse paths that were not obvious before.

The Same Mistake, Twice

The February 2025 version of this incident barely made the news. This one did, because Claude Code is now a lot bigger and March 2026 was already a bad month for the developer toolchain. The security community was already watching closely after the LiteLLM PyPI supply chain attack, the axios npm RAT deployment, and the Qihoo 360 SSL key exposure.

March 2026 was a rough month for the developer toolchain. Three supply chain attacks, and then this. The difference is that the others were malicious. The Claude Code leak was just a mistake, by the company that arguably should be the most careful about this.

Why This Keeps Happening

This is not really a carelessness problem. It is a process gap. Most engineering teams have no automated check that looks at what is actually inside a package before it ships.

A typical npm publish flow goes: write code, pass tests, bump version, publish. Done. At no point does anything automatically ask “does this package contain something it should not?” Source maps, API keys, private certs, internal config, debug output. All of these have shipped to public registries by good engineers at good companies. Not because they were careless, but because the check was never there.

How ReleaseGuard Would Have Caught This

Helixar ReleaseGuard is a free, open-source tool that scans a release artifact before it goes to the registry and flags anything that should not be there. It is built for exactly this type of problem. The Claude Code incident had three signals it would have caught before npm publish ever ran:

ReleaseGuard plugs into your CI pipeline and runs these checks on every release candidate automatically. The engineer publishing does not need to remember to check. The gate is just always there.

# See exactly what npm would publish
npm pack --dry-run

# Check for .map files specifically
npm pack --dry-run 2>&1 | grep -E '\.map$'

# Or unpack the tarball and inspect
npm pack && tar tzf your-package-*.tgz | grep -E '\.map$|\.env|credentials'

What This Means for AI Tool Security

AI coding tools are different from regular software in one important way: they actively participate in writing code. Claude Code, Cursor, and GitHub Copilot are not just installed on a developer's machine. They read files, write files, run commands, and make decisions. That makes their internals more valuable to an attacker than the internals of most software.

When you know how Claude Code routes prompts and what tool interfaces it exposes, you can build attacks that are specifically designed to work against it. The tool has not been hacked. But the information advantage that made it harder to attack is gone.

We looked at the broader supply chain risk around AI development tools in Your Developer's AI Copilot Is the New Attack Surface. The Claude Code leak adds a new angle: it is not just outside attackers you need to worry about. The teams building these tools also need to treat their release pipelines as a security boundary.

What Needs to Change

Anthropic moved fast. They confirmed it the same day, were honest about what happened, and said they are putting in controls to stop it happening again. That is the right response. But “we will add preventive measures” after it happens a second time needs a concrete answer: what is the specific gate, and when does it run?