Anthropic Accidentally Exposes Claude Code Source via npm Package
Anthropic confirmed that part of Claude Code's source code was accidentally exposed when a debug file was included in an npm package release on March 31, 2026, due to human error during packaging. No customer data or credentials were compromised, but the exposure allows competitors to analyze the tool's internal architecture and implementation details.
What happened
Anthropic confirmed on March 31, 2026 that part of the internal source code of Claude Code was accidentally exposed. According to the company, a release inadvertently published a debug file (source map) in the npm package repository during a packaging process error attributed to human error.
A post on social media X with a link to the exposed code exceeded 21 million views within hours of being published on the morning of March 31. The company stated the incident was not the result of a security breach and that no sensitive customer data or credentials were exposed.
Reported impact
The exposure allows developers and rival companies to analyze in greater detail how Claude Code was constructed, including its architecture choices and solutions adopted for typical AI agent problems. This represents a setback for Anthropic given Claude Code's strong adoption and contribution to over US$ 2.5 billion in annualized revenue as of February 2026.
Index analysis
The source map file type is used to transform the final product into more readable code for debugging purposes, which can reveal how the company's AI functions when it reaches the wrong hands. A public npm package is widely used by developers, making errors there likely to be rapidly replicated and mirrored across repositories.
Governance controls
Anthropic stated it was already adopting measures to prevent future episodes and that the problem was not a security violation but a packaging error during the release process.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.