Anthropic Claude Source Code Leaked Via npm Registry

Key Takeaways

• Anthropic’s proprietary Claude Code CLI tool’s complete TypeScript source code was inadvertently exposed.
• A security researcher discovered the leak in a misconfigured npm package containing a source map (`.map`) file.
• The exposed codebase includes over 512,000 lines of code, internal API logic, authentication flows, and unreleased feature flags.
• The leak raises significant intellectual property concerns for Anthropic.

Anthropic, a prominent AI research company, has inadvertently exposed the complete TypeScript source code for its proprietary Claude Code command-line interface (CLI) tool. The sensitive code was discovered by a security researcher within a misconfigured npm package, which contained a source map (`.map`) file directly referencing the tool’s unobfuscated codebase hosted on Anthropic’s cloud infrastructure.

The disclosure was made public on March 31, 2026, by researcher Chaofan Shou, who announced, “Claude code source code has been leaked via a map file in their npm registry!” Shou’s post highlighted the existence of the exposed code and provided links.

The @anthropic-ai/claude-code npm package reportedly included a source map file that linked to the full, unminified TypeScript source. This source was available for direct download as a ZIP archive from Anthropic’s R2 cloud storage bucket. Subsequently, the original, unmodified source code has been mirrored and preserved in a public GitHub repository under the nirholas/claude-code backup branch.

What Was Exposed

The leaked codebase encompasses the entirety of the Claude Code’s src/ directory, containing approximately 1,900 files and over 512,000 lines of code. The tool is written in strict TypeScript, leveraging the Bun runtime and a React + Ink terminal UI framework. This extensive disclosure impacts every critical subsystem of the CLI tool.

Among the key files confirmed in the leak are QueryEngine.ts, comprising roughly 46,000 lines, which controls the core LLM API engine, including streaming, tool loops, and token tracking. Also exposed is Tool.ts, approximately 29,000 lines, defining all agent tool types and permission schemas, alongside commands.ts, about 25,000 lines, responsible for registering and executing the tool’s slash commands.

The exposed architecture details around 40 distinct agent tools, such as BashTool, FileReadTool, FileEditTool, and AgentTool for sub-agent spawning. Additionally, approximately 85 slash commands were revealed, covering functionalities like Git workflows, code review, memory management, and multi-agent orchestration.

Intriguingly, the leak also unveiled internal feature flags, including PROACTIVE, VOICE_MODE, BRIDGE_MODE, and KAIROS. These flags suggest product features that have not yet been publicly released by Anthropic, offering a glimpse into future development.

How Source Maps Cause Leaks

Source map files (.map) are standard components in web development, used by developers to map compiled or minified JavaScript back to its original source code. This functionality is crucial for debugging applications in production environments.

However, when these files are inadvertently bundled into production npm releases, they can expose proprietary source code to anyone with the knowledge to locate them, effectively nullifying any obfuscation efforts. This is not an isolated incident for Anthropic; a similar source map exposure was reportedly addressed and patched in early 2025, indicating a recurring vulnerability in their deployment practices.

The current breach raises significant intellectual property concerns for Anthropic. The exposed code contains internal API client logic, OAuth 2.0 authentication flows, permission enforcement mechanisms, multi-agent coordination strategies, and even details of undisclosed feature pipelines. As of the time of writing, Anthropic has not released a public statement regarding this incident.

What You Should Do

• Organizations integrating Claude Code into their development workflows should closely monitor Anthropic’s official security advisories for updates.
• Developers are strongly advised to review the official npm registry for patched releases of the @anthropic-ai/claude-code package.
• Avoid using or relying on third-party mirrors or unofficial distributions of the leaked source code to prevent potential security risks and maintain code integrity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.