Anthropic Accidentally Exposes Claude Code Source Through npm Build Error
An Anthropic build pipeline mistake ships Claude Code's full source code via an exposed map file, spreading quickly across GitHub.
Anthropic makes a major publishing blunder by accidentally including a source map file in the official Claude Code npm package. Security researcher Chaofan Shou discovers the error and reveals that the map file points directly to an unobfuscated TypeScript zip archive hosted on Anthropic's Cloudflare R2 storage bucket, allowing anyone to download the complete contents.
The leaked archive contains around 1,900 TypeScript files totaling over 512,000 lines of code, along with full libraries of slash commands and built-in tools. The exposed code quickly spreads across the internet after a user uploads a snapshot to GitHub, where the repository earns more than 41,500 forks in a very short time.
While this leak does not completely demystify Claude Code since the community already reverse engineers the tool extensively, it provides a fresh and comprehensive look at the latest iteration of the software. The most surprising aspect of the incident is the sheer carelessness of leaving a debug map file in a production build, a basic mistake that unnecessarily exposes proprietary intellectual property.