Incident Overview
On March 31, 2026, Anthropic inadvertently exposed the full source code of Claude Code, its terminal-based AI coding assistant, through a 59.8 MB JavaScript source map file (.map) included in the npm package @anthropic-ai/claude-code version 2.1.88. The leak occurred due to a packaging error where the source map file, generated by default by the Bun runtime, was not excluded in the .npmignore file or the package.json’s files field. This file contained approximately 513,000 lines of unobfuscated TypeScript across 1,906 files, revealing the complete client-side implementation of Claude Code.
The exposed source map referenced a ZIP archive of the original TypeScript sources hosted on Anthropic’s Cloudflare R2 bucket. Within hours of the leak being publicly disclosed by security researcher Chaofan Shou on X, the file was downloaded from Anthropic’s infrastructure and mirrored across GitHub, accumulating tens of thousands of forks and stars. The rapid dissemination of the codebase created a significant risk for supply chain attacks, as threat actors exploited the leak to distribute malware under the guise of hosting the official source.
The leaked code included critical components such as agent orchestration logic (LLM API calls, streaming, tool-call loops, and multi-agent coordination), permission and execution layers (hooks, Model Context Protocol integrations, environment variable handling, and project-load flows), memory and state management (persistent memory systems and autonomous daemons), and security-related internals (telemetry analysis, encryption tools, inter-process communication, and OAuth flows). Additionally, 44 feature flags—including over 20 unshipped features—were exposed, along with internal API designs and system prompts. However, model weights, safety pipelines, and user data remained unexposed.
Threat actors quickly capitalized on the leak by creating fake repositories on GitHub claiming to host the official source code. These repositories were designed to lure developers into downloading malicious payloads, including Vidar, an information-stealing malware, and GhostSocks, a proxy tool used to route network traffic. Zscaler’s ThreatLabz identified at least one malicious repository, published by the actor idbzoomh, which distributed a Rust-based dropper named ClaudeCode_x64.exe. This executable deployed Vidar v18.7 and GhostSocks upon execution.
The malicious repositories appeared prominently in search results for terms like leaked Claude Code, increasing the likelihood of unsuspecting users encountering them. The threat actor updated the malicious ZIP archives in short intervals, demonstrating active maintenance of the campaign. Zscaler also observed a secondary repository under a different account, which contained identical lures but lacked functional download links at the time of analysis.
The incident also coincided with a separate malicious npm supply chain attack involving the Axios package, which distributed remote access trojans (RATs) between March 31, 00:21–03:29 UTC. This overlap created a compounded risk for developers updating Claude Code via npm during that period, as both the source code leak and the Axios attack could have led to compromised environments.
Anthropic responded by removing the source map file from the npm package and issuing Digital Millennium Copyright Act (DMCA) notices to some mirrored repositories. However, the widespread distribution of the codebase made containment challenging, as hundreds of public repositories continued to host the leaked or modified versions of the source.
Possible Root Cause
The root cause of the Claude Code source leak was a misconfiguration in the npm package build process. The Bun runtime, used to package the application, generated a source map file by default, which included a complete reference to the original TypeScript source code. This file was not explicitly excluded in the .npmignore configuration or the files field of the package.json, allowing it to be included in the public npm release.
While they are useful during development, they should not be included in production releases, especially when the source code contains proprietary or sensitive logic. In this case, the source map file acted as a backdoor to the full implementation, exposing internal architecture, security mechanisms, and unshipped features that were intended to remain confidential.
The leak highlighted a broader issue in software packaging practices, where debugging artifacts or intermediate files are inadvertently included in public releases. Developers and organizations must ensure that such files are explicitly excluded during the build process to prevent unintended exposure of sensitive information.
The rapid dissemination of the leaked code was further exacerbated by the open nature of GitHub and npm ecosystems. Once the source map was publicly accessible, it was quickly mirrored, forked, and redistributed by developers and threat actors alike. The lack of immediate containment measures allowed the codebase to spread uncontrollably, increasing the attack surface for malicious actors.
Takeaways
The Claude Code leak underscores the risks associated with supply chain attacks in open-source and developer tool ecosystems. Threat actors can exploit even minor misconfigurations to distribute malware, steal sensitive data, or compromise local environments. Organizations must adopt proactive measures to mitigate such risks, including verifying the authenticity of source code repositories and avoiding unofficial or untrusted distributions.
One of the primary risks identified in the aftermath of the leak was the potential for trojanized repositories to introduce backdoors, data exfiltration mechanisms, or cryptominers into developer environments. The exposed hook and permission logic in Claude Code made it particularly vulnerable to silent device takeover, as malicious actors could craft precise payloads that trigger arbitrary shell execution or credential theft simply by cloning or opening an untrusted repository.
- Verify every source of code against official channels only. Avoid downloading, forking, or running code from third-party repositories claiming to host leaked or unofficial versions of proprietary software.
- Implement Zero Trust architecture to segment access to critical applications and monitor for anomalous telemetry or outbound connections from developer workstations.
- Educate developers about the dangers of running unvetted or unmodified code, even if it appears to be from a trusted source. Leaked code remains proprietary and may contain hidden vulnerabilities or malicious modifications.
- Scan local environments and Git clones for suspicious processes, modified hooks, or unexpected npm packages. Exercise caution when updating packages, especially during periods of known supply chain attacks.
- Monitor for patches or updates from official sources that address newly exposed paths or vulnerabilities.
- Avoid running AI agents with local shell or tool access on untrusted codebases. Restrict execution environments to minimize the risk of unauthorized commands or data exfiltration.
The incident also revealed the speed at which threat actors can weaponize publicized leaks. Within hours of the Claude Code source being exposed, malicious repositories were created, and malware campaigns were underway. This rapid response highlights the need for organizations to maintain vigilance and respond swiftly to potential security incidents, including the issuance of DMCA notices and the removal of compromised artifacts from public distributions.
This includes not only the final product but also intermediate artifacts, configuration files, and dependencies that may inadvertently expose sensitive information. By adopting rigorous security practices and maintaining awareness of emerging threats, organizations can reduce their exposure to supply chain attacks and other forms of exploitation.