Anthropic Says npm Packaging Mistake Exposed Claude Code Source
Anthropic confirmed on Tuesday that internal source files for its Claude Code coding assistant were accidentally published because of a human error during packaging. The company told reporters that no customer secrets or credentials appear to have been leaked, and characterized the incident as a release-packaging mistake rather than a security intrusion. Anthropic also said it is deploying fixes to avoid a repeat.
The issue was traced to version 2.1.88 of the Claude Code npm package, which included a source map that allowed observers to reconstruct the project’s source. That artifact expanded into a codebase of almost 2,000 TypeScript files totaling more than 512,000 lines. The problematic release has since been removed from the npm registry.
Security researcher Chaofan Shou was the first to call attention to the problem publicly on X, noting that a map file in the npm entry exposed the code. That post quickly drew massive attention, accumulating upwards of 28.8 million views. Meanwhile, the reconstructed codebase remains available in a public GitHub repository that has attracted more than 84,000 stars and some 82,000 forks.
Analysts warned that the disclosure gives developers and competitors a detailed picture of how Claude Code operates. Inspectors who examined the files have published findings about a “self-healing” memory design that attempts to work around the model’s fixed context window limits, along with a range of other internal subsystems.
Among the internal mechanisms visible in the leak are a tools layer that enables actions such as reading files and executing bash commands; a query engine responsible for orchestrating calls to LLM APIs; a multi-agent orchestration system that can spawn subordinate “sub-agents” or swarms for complex workflows; and a bidirectional communications layer that links IDE extensions to the Claude Code CLI.
The leak also disclosed a capability called KAIROS, which turns Claude Code into a persistent background agent able to periodically correct errors, run tasks autonomously, and issue push notifications to users. A complementary “dream” mode was found in the code that lets the assistant continuously mull over ideas and iterate on them in the background.
Researchers discovered an “Undercover Mode” designed to let the tool contribute to public open-source projects quietly; system prompts in the repository instruct the agent to avoid including Anthropic-internal information in commit messages, PR titles and bodies so it does not reveal its origin. Another notable defensive approach identified in the files attempts to poison downstream model-distillation efforts by inserting bogus tool definitions into API outputs if scraping is detected.
Security experts cautioned that the exposure of internals makes it easier for adversaries to craft attacks that bypass existing safeguards. AI security firm Straiker noted that attackers no longer need to brute-force jailbreaks - they can study and fuzz the four-stage context management pipeline to design payloads that survive compaction and effectively persist a backdoor across long sessions.
There are also immediate supply-chain concerns. Users who installed or updated Claude Code from npm on March 31, 2026 between 00:21 and 03:29 UTC may have pulled a trojanized copy of the HTTP client that included a cross-platform remote access trojan as part of an Axios supply-chain compromise. Affected users are advised to downgrade to a known-good release and rotate any secrets that could have been exposed.
Attackers have already begun typosquatting names of internal npm packages exposed by the leak to reap downloads and later push malicious updates. Packages published by a user named “pacifier136” include audio-capture-napi, color-diff-napi, image-processor-napi, modifiers-napi and url-handler-napi. At present, these packages are empty stubs (exporting an empty module), but researchers warn that the typical attack pattern is to occupy the name, wait for adoption, then release a malicious update that impacts everyone who installed it.
The episode is the second notable Anthropic operational lapse in a week. Last week, details about the company’s forthcoming AI model and other internal materials were left accessible via its content management system. Anthropic has confirmed it is testing the new model with early access customers and described it as the most capable system it has built so far, according to reporting by Fortune.