Claude Code Leak: What You Need to Know

On March 31, 2026 community reports highlighted that Anthropic’s @anthropic-ai/claude-code npm package (v2.1.88) accidentally included a cli.js.map source map, enabling reconstruction of internal source and revealing implementation details; Anthropic has characterized the event as a release packaging mistake rather than a backend breach. The exposure lowers the bar for reverse engineering, may reveal hidden configuration/feature flags, and has already prompted typosquatting and dependency-confusion attempts, so defenders are advised to pin versions, inspect internal mirrors for .map files, tighten developer endpoint controls, and monitor for lookalike packages.