Claude Code's source code has been leaked via a map file in their NPM registry
A debug map file in the public NPM registry contained the full, unminified source code for Claude Code.
The source code for Anthropic's Claude Code, a specialized AI model for software development, was inadvertently exposed in a public software repository. The leak occurred when a debug 'source map' file, intended to help developers trace errors in minified code, was published to the NPM (Node Package Manager) registry. This .map file contained a direct mapping back to the original, unminified TypeScript source code, effectively making the entire codebase readable. Security researchers discovered the file, which was publicly accessible for an unknown period, allowing anyone to download and examine the proprietary logic powering the coding assistant.
Analysis of the leaked code reveals the internal architecture of Claude Code, including how it structures API calls to Anthropic's servers, manages conversation context, and implements its specific coding workflows. The exposure includes potentially sensitive prompt templates and logic for handling different programming languages. While the leak does not expose user data or API keys, it provides a blueprint of the product's inner workings. This gives competitors a significant advantage in understanding and potentially replicating its approach, and could aid security researchers—or malicious actors—in probing for vulnerabilities in the client-side application.
- Source code leaked via a public `claude-code.map` file in the NPM registry, exposing unminified TypeScript.
- The map file revealed core application logic, API integration patterns, and internal prompt structures.
- Exposure risks competitive analysis and potential security vulnerability discovery, though no user data was compromised.
Why It Matters
This leak undermines Anthropic's intellectual property, giving rivals a free look at a key product's architecture and potentially impacting its competitive edge.