Anthropic’s Claude code leak exposes 513,000 lines of source code, sparks malware campaigns

A single missing configuration in a release pipeline turned Anthropic’s Claude Code into an open book. On March 31, version 2.1.88 of the Claude Code CLI tool shipped via npm with a 59.8 MB source map file that was never supposed to leave the building, exposing approximately 513,000 lines of unobfuscated TypeScript source code across 1,906 internal files. Within hours, the code was mirrored to GitHub. Forks multiplied. And opportunistic actors spun up fake repositories laced with malware, targeting developers who came looking for the leaked source. Anthropic’s attempt at damage control, filing DMCA takedown requests, ended up disrupting roughly 8,100 GitHub repositories, many of which had nothing to do with the incident. What actually happened The exposure wasn’t a hack. Source map files are debugging tools that map compiled code back to its original source. They’re useful during development. They’re catastrophic when shipped to production. Anthropic confirmed as much in its response, stating that the mishap was “a release packaging issue caused by human error, not a security breach.” The company emphasized that no sensitive customer data or credentials were compromised in the expo...