Claude Code source leaks through an npm source map, on the same day as an axios attack

On 31 March 2026 the source code of Claude Code, Anthropic's agentic command-line coding tool, became publicly readable after a 59.8 MB JavaScript source-map file was shipped by mistake inside version 2.1.88 of the @anthropic-ai/claude-code npm package. Source maps exist to let developers debug minified bundles; this one reconstructed roughly 512,000 lines of TypeScript. An engineer at a crypto start-up spotted the file and posted about it on X in the early hours of the morning, and mirrors of the reconstructed codebase spread across GitHub within hours.

What the code revealed was mostly architectural: a multi-layer memory system, an autonomous background daemon mode, internal model codenames including an unreleased model, an unreleased mode for contributing to open-source repositories without disclosing the tool, and internal test metrics, among them a false-claims rate of around 29 to 30% recorded in evaluations. Anthropic described the event as a release-packaging error caused by human mistake rather than a security breach, said no customer data or credentials were exposed, and committed to preventive measures. Copies were pulled from GitHub through takedown requests, but the code had already been widely archived.

The same night, a separate supply-chain attack hit the ubiquitous axios HTTP library. Between roughly 00:21 and 03:29 UTC on 31 March, malicious versions were published to npm that installed a remote access trojan on machines that updated during that window. The two incidents are unrelated in cause but arrived together, and within days security researchers reported fake "Claude Code source" repositories being used to distribute malware to curious developers.

The episode matters less for what competitors learned about Claude Code than for what it says about the software supply chain that AI tooling now sits on. Agentic coding tools run with developer privileges, are updated frequently, and pull hundreds of transitive dependencies. A packaging slip at a frontier lab and a hijacked maintainer account on a foundational library both landed in developer environments through the same channel, npm, in the same hours. OWASP's GenAI project would later log the leak in its Q1 2026 exploit round-up alongside other supply-chain events.

What it means for leaders

• Pin and verify AI developer tooling. Treat Claude Code, Codex CLI and similar agents as privileged software: pin versions, delay upgrades by a cooling-off period, and verify package provenance and signatures.
• Apply OWASP LLM Top 10 supply-chain controls (LLM03) to the toolchain, not just the model. SBOMs, dependency scanning and registry allow-lists should cover the agents that write your code.
• Assume secrets in reach of an agent are exposed on compromise. Coding agents see environment variables, tokens and repositories; scope credentials tightly and rotate them after any incident like the axios window.
• Warn developers about lure repositories. Social-engineering campaigns built on high-profile leaks are predictable; update phishing awareness accordingly.
• Ask vendors about release engineering. Source-map exposure is a basic build-hygiene control; include build-pipeline attestations in AI procurement questionnaires and ISO/IEC 42001 supplier reviews.