Anthropic · 2026-04-03 · major
Claude Code npm Packaging Error Exposes 512,000 Lines of Source Code Including Anti-Distillation Controls
A 59.8MB source map in @anthropic-ai/claude-code v2.1.88 exposed 512k TypeScript lines including 'Undercover Mode' and anti-distillation controls. Threat actors immediately exploited the attention: Vidar stealer + GhostSocks proxy via fake 'Leaked Claude Code' GitHub repo.
Anthropic accidentally shipped its entire source code in an npm package, revealing internal secrets — and enabling a downstream supply-chain attack within hours.
What is it?
Version 2.1.88 of @anthropic-ai/claude-code, published March 31, 2026, contained an unintentional 59.8MB source map file exposing 512,000 lines of unobfuscated TypeScript across 1,906 files.
How does it work?
Security researcher Chaofan Shou detected the exposed source map and posted to X at 4:23 UTC. The readable source revealed: a self-healing memory system (KAIROS), 44 unreleased feature flags, an 'Undercover Mode' for making open-source contributions without revealing Anthropic's involvement, and anti-distillation controls designed to poison competitor training data. Within hours, threat actors published malicious axios versions (1.14.1 and 0.30.4) containing a Remote Access Trojan, targeting developers who had just updated Claude Code.
Why does it matter?
Anyone who updated Claude Code via npm between 00:21 and 03:29 UTC on March 31 may have pulled the malicious axios RAT. The leak also exposed attack paths against Claude Code's permission model, prompting CrowdStrike's CTO to warn publicly about over-privileged agents.
Who is it for?
Developers who updated Claude Code on March 31 should immediately check their npm lock files for axios 1.14.1 or 0.30.4 and rotate any secrets in scoped environments.