Anthropic’s Claude Code Source Code Reportedly Leaked Via Their npm Registry

Anthropic's proprietary Claude Code CLI source (~1,900 files, ~512k LOC) was inadvertently exposed when an npm package included a source map pointing to unminified TypeScript downloadable from Anthropic's R2 cloud storage; the leak reveals core subsystems, OAuth2/authentication logic, permission schemas, internal tools and unreleased feature flags and was publicly disclosed by a security researcher on March 31, 2026.