Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms

Anthropic accidentally published Claude Code's source code in an npm package source map, making ~2,000 TypeScript files publicly available and revealing internal architectures and covert features; although the company says no customer data was exposed, the leak enabled researchers and attackers to analyze internals. Concurrently, a potentially trojanized axios package was published and may have been downloaded during a narrow window, and adversaries have typosquatted internal npm package names to set up dependency-confusion or malicious updates, creating a significant supply-chain and operational security risk.