The Claude Code Leak: What Actually Happened and What Developers Found Inside

On March 31, 2026, Anthropic accidentally shipped the entire source code of Claude Code to the public npm registry. Not through a hack. Not through a breach. Through a single misconfigured build file. Here is the full breakdown of what happened, what was inside, and what you need to do if you updated that day. --- ## How it happened When Anthropic published Claude Code version 2.1.88 to npm, the package included a 60 MB file called `cli.js.map` that contained the full source code for the latest version. Source map files are meant for internal debugging. They link compiled JavaScript back to the original source. The problem is that if the map file includes a field called `sourcesContent` that embeds the full text of original source files directly, anyone who downloads the package can reconstruct the entire codebase from it. The mistake is almost always the same: someone forgets to add `*.map` to their `.npmignore` or does not configure their bundler to skip source map generation for production builds. With Bun's bundler, which Claude Code uses, source maps are generated by default unless you explicitly turn them off. Security researcher Chaofan Shou spotted the exposure and told the world. Snapshots of Claude Code's source code were quickly backed up in a GitHub repository that has been forked more than 41,500 times so far. Anthropic confirmed the leak and said no personal or sensitive information was published, calling it "a release packaging issue caused by human error, not a security breach." By the time the package was pulled, it was too late. The code was already mirrored everywhere. --- ## What was inside The reconstructed source code contains approximately 1,900 files and 500,000 lines of code, with details of several Claude-exclusive features. The most significant technical findings developers pulled out of the leak: **The system prompt lives in the CLI.** This was genuinely surprising to a lot of people. Claude Code's full system prompt, the instructions that shape how it reasons and behaves, was sitting inside a distributed package. That means anyone can now read exactly how Anthropic instructs Claude Code to operate, including its guidance on tool use, git safety, parallel execution, and file editing behavior. **A three-layer memory architecture.** The leaked source reveals a sophisticated three-layer memory architecture that moves away from traditional "store-everything" retrieval. At its core is MEMORY.md, a lightweight index of pointers that is perpetually loaded into the context. This is how Anthropic solved context entropy, the tendency for long-running agent sessions to become confused or hallucinatory as the context window fills up. **Unshipped features.** The codebase is significantly ahead of the public release. Features like KAIROS (an always-on Claude), ULTRAPLAN (a 30-minute remote planning system), a Buddy companion, coordinator mode, agent swarms, and workflow scripts are all feature-gated and invisible in external builds. **Parallel tool execution is intentional.** Claude Code is explicitly instructed to run independent tool calls in parallel. This is not an emergent behavior. It is baked into the system prompt. **Undercover Mode.** There is an entire system called Undercover Mode specifically designed to prevent Anthropic's internal information from leaking, built to stop the AI from accidentally revealing internal codenames in git commits. The irony of that existing while the source code sat publicly on npm is not lost on anyone. --- ## The security situation you actually need to care about Here is the part that matters more than the intellectual property story. Coinciding with the leak, but entirely unrelated to it, was a real supply chain attack on npm. Malicious versions of the widely used axios HTTP library were published containing an embedded Remote Access Trojan. If you installed or updated Claude Code via npm on March 31, 2026, between 00:21 and 03:29 UTC, you may have inadvertently pulled in a malicious version of axios that contains a Remote Access Trojan. You should immediately search your project lockfiles for versions 1.14.1 or 0.30.4 of axios, or for the dependency `plain-crypto-js`. If found, treat the host machine as fully compromised, rotate all secrets, and perform a clean OS reinstallation. On top of that, threat actors are already capitalizing on the leak to typosquat internal npm package names in an attempt to target developers who may be trying to compile the leaked source code. Right now the packages are empty stubs, but that is how these attacks work: squat the name, wait for downloads, then push a malicious update that hits everyone who installed it. Do not try to compile the leaked code and pull in packages from npm to fill in missing dependencies. That is exactly the attack vector people are actively exploiting right now. Anthropic has designated the native installer as the recommended method going forward: `curl -fsSL https://claude.ai/install.sh | bash`. It uses a standalone binary that does not rely on the volatile npm dependency chain and supports background auto-updates. --- ## What this means for the AI tooling space The competitive implications are real. The leak provides competitors a literal blueprint for how to build a high-agency, reliable, and commercially viable AI agent. The multi-agent coordination patterns, the permission system, the tool plugin design, the memory architecture. It is all documented in detail now and has been analyzed by thousands of developers. The engineering that came out of the leak is genuinely impressive. The multi-agent coordination, the dream system, the three-gate trigger architecture, the compile-time feature elimination. These are deeply considered systems. This is not a weekend project wrapped in a CLI. For developers building AI tools, the leaked source is now the most detailed public documentation of how to build a production-grade AI agent harness that exists. The bar for what "production-grade" means just got documented in detail. --- ## The lesson for every engineering team This is a reminder for every engineering team: check your build pipeline. Make sure `.map` files are excluded from your publish configuration. A single misconfigured `.npmignore` or `files` field in `package.json` can expose everything. It is ironic that a tool designed to help engineers write better code was undone by a build configuration oversight. But that is exactly the kind of thing that slips through when teams are moving fast and shipping regularly. The practical lesson is not just about `.npmignore`. It is about auditing what actually ends up in your published packages before they go out. Run `npm pack` and inspect the contents. Know what you are shipping. --- ## Quick summary of what to do right now If you use Claude Code, switch to the native installer and move off npm. If you updated via npm on March 31 between 00:21 and 03:29 UTC, check your lockfiles for the malicious axios versions and rotate your credentials if you find them. Do not attempt to compile the leaked source code and pull dependencies from npm to make it build. The leak itself is a fascinating look inside one of the most well-engineered developer tools in the AI space right now. But the security situation around it is not something to take lightly.