Anthropic has confirmed that internal source code for its Claude Code AI coding assistant was inadvertently leaked due to a packaging error in its npm release process. While the company stressed that no customer data or credentials were exposed, the incident has raised serious questions about supply chain security and the risks of source code leaks in the AI industry.
What Happened
- On March 31, 2026, version 2.1.88 of the Claude Code npm package was published with a source map file that exposed nearly 2,000 TypeScript files and over 512,000 lines of code.
- The package was quickly pulled, but the leaked codebase spread rapidly, appearing on GitHub where it has already amassed 84,000 stars and 82,000 forks.
- Security researcher Chaofan Shou first flagged the issue on X, where the post went viral with nearly 29 million views.
Inside the Leak
Developers analyzing the leaked code have uncovered details of Claude Code’s internal architecture:
- Self-healing memory system to overcome context window limits.
- Multi-agent orchestration for spawning sub-agents to handle complex tasks.
- KAIROS mode for persistent background operation and proactive error fixing.
- Dream mode for continuous background thinking and iteration.
- Undercover Mode for stealth contributions to open-source repositories.
- Anti-distillation defenses that inject fake tool definitions to poison competitor training data.
Security Fallout
The leak has already triggered malicious activity:
- Typosquatting attacks: Empty npm packages mimicking Claude’s internal dependencies have been published, likely to stage future dependency confusion attacks.
- Supply chain overlap: Users who installed Claude Code during the Axios compromise window may have inadvertently pulled a trojanized HTTP client containing a cross-platform RAT.
- Exploitation risk: Attackers can now study Claude’s context management pipeline to craft payloads that persist across sessions.
Defensive Guidance
- Downgrade immediately: Users should revert to safe Claude Code versions prior to 2.1.88.
- Rotate secrets: API keys, tokens, and credentials on affected systems should be reset.
- Audit dependencies: Check for typosquatted packages like
audio-capture-napi,color-diff-napi, and others. - Contain hosts: Treat any system that installed the compromised package as potentially breached.
Bigger Picture
This is Anthropic’s second major blunder in a week, following a CMS misconfiguration that exposed details of its upcoming AI model. Together, these incidents highlight the fragility of modern AI development pipelines and the risks of human error in package management.
Final Thought
The Claude Code leak is more than a packaging mistake — it’s a blueprint for adversaries. In the AI arms race, protecting source code is as critical as protecting customer data. For defenders, the lesson is clear: supply chain vigilance and rapid containment are non-negotiable in safeguarding the future of AI.
Leave a Reply