:%20What%20Happened%20on%20March%2031,%202026%20and%20What%20It%20Means%20for%20Builders?unique=dfd2b14)
AI news
The Claude Code leak happened on March 31, 2026, when version 2.1.88 of Anthropic's @anthropic-ai/claude-code npm package shipped with a source map that let anyone rebuild more than 512,000 lines of its TypeScript source. Anthropic called it a release packaging issue caused by human error, not a security breach, and said no customer data or credentials were exposed.
Within hours the material was mirrored across GitHub, X, Reddit and Hacker News; one GitHub copy passed 84,000 stars and 82,000 forks in early April 2026. Here is what actually happened, what was exposed, what was not, and what every software team should do differently because of it.
What happened in the Claude Code v2.1.88 source map leak?
Anthropic published Claude Code 2.1.88 to npm with a JavaScript source map inside. A source map links minified code back to its original files, so it let readers reconstruct the tool's TypeScript source. Security researcher Chaofan Shou flagged it on X the same day, and Anthropic confirmed a packaging mistake rather than an attack.
Anthropic published Claude Code v2.1.88 through its standard npm distribution channel. The package inadvertently included a JavaScript source map, a file type designed for debugging that maps minified output back to the original TypeScript source files, line by line.
Because source maps preserve file names, module boundaries, function names and internal comments, observers were able to reconstruct a substantial share of Claude Code's proprietary implementation: reports put it at more than 512,000 lines in nearly 2,000 TypeScript files. Anthropic's statement, given to CNBC, called it "a release packaging issue caused by human error, not a security breach", and added that no sensitive customer data or credentials were involved or exposed.
Claude Code leak timeline
The leak, the response and a separate npm attack all landed within three days. Times are in UTC where the sources give them.
March 31, 2026, 00:21 to about 03:29
Malicious axios versions on npm
Attackers who took over an axios maintainer's npm account published axios 1.14.1 and 0.30.4 with a remote access trojan; npm removed them within hours. This was a separate incident from the leak.
March 31, 2026
Source map found in Claude Code 2.1.88
Chaofan Shou posted on X that the npm package's map file exposed the source. Copies spread to GitHub within hours.
March 31, 2026
Anthropic confirms a packaging error
Anthropic said it was human error, not a security breach, that no customer data or credentials were exposed, and that it was rolling out measures to prevent a repeat. Version 2.1.88 has since been removed from npm.
April 1, 2026
GitHub takedown, then a retraction
Anthropic's copyright notice reached about 8,100 repositories, including legitimate forks of its public Claude Code repository. Anthropic called that an accident and limited the takedown to one repository and 96 forks.
April 2, 2026
"April Fools' stunt" claim debunked
Lead Stories rated false a screenshot titled "We Leaked Nothing" that presented the leak as a planned prank.
Sources: The Hacker News, TechCrunch, Lead Stories and Trend Micro.
What did the Claude Code source map expose?
Developer analysis of the rebuilt source identified several categories of disclosed material. These come from people reading the code, not from Anthropic announcements, and unreleased features may change or never ship.
Internal TypeScript codebase
Architecture, module structure and component relationships, reconstructed at scale: more than 512,000 lines in community and press reports.
Feature flags and unreleased capabilities
Read widely as roadmap signals, including KAIROS, a reported always-on assistant mode, and cross-session memory mechanisms.
Memory architecture hints
Details on how Claude Code manages context across sessions, an area that sets coding agents apart from each other.
Engineering comments
Internal tradeoff notes that spread faster on social platforms than any formal announcement would.
A link to the full source archive
The map pointed to a zip archive of the source on Anthropic's cloud storage, which anyone could download.
A Tamagotchi-style companion
Reported under the name Buddy: a virtual pet that reacts while you code, and one of the details shared most widely.
What was leaked in the Claude Code leak, and what was not?
The leak exposed the source of the command-line tool, not Anthropic's models or its customers. The table separates what reports describe as exposed from what nobody has reported as exposed.
| Reported as exposed | Not reported as exposed |
|---|---|
| Internal TypeScript source (via source-map reconstruction) | Claude model weights |
| Feature flags and roadmap-like signals | Customer data or user content |
| Memory and agent architecture patterns | API keys or credentials |
| Engineering tradeoff comments | Evidence of external attacker access |
- 512,000+lines of TypeScript reported in the rebuilt source
- ~2,000source files behind the map, per press reports
- 2.1.88the Claude Code version removed from npm
- 1 + 96repository and forks left in Anthropic's narrowed takedown
In the era of AI agents, the product harness is part of the moat, and packaging is part of the harness.
Is Claude Code safe to use after the leak?
Anthropic's position is that no customer data or credentials were exposed and that the leak was not a breach of its systems. The practical risks came from what happened around it: a separate npm attack the same morning, and copies of the code turned into bait.
- Install from the official source. Security firms reported fake "leaked Claude Code" repositories that deliver malware, and look-alike npm package names that Anthropic has since reserved to block dependency confusion.
- Keep Claude Code current. Version 2.1.88 is no longer on npm; check your installed version and update to the current release.
- Leave the leaked copies alone. Anthropic has filed copyright takedowns against copies of the source, and fake copies have been used to spread malware.
Installed npm packages on March 31? Check for the axios trojan
Search your lockfiles and node_modules for axios 1.14.1 or 0.30.4 and a dependency named plain-crypto-js. The Hacker News advised anyone who installed or updated Claude Code through npm between 00:21 and 03:29 UTC that day to check, and to rotate secrets if either version turns up. No report confirms that Claude Code itself shipped the trojan.
What should every dev team do after this incident?
The Claude Code leak was not a hack: it was a packaging mistake with the reach of a strategic disclosure. The lesson for any team shipping AI tooling is to make the dull release process as solid as the demos.
Audit every build artifact before publishing
Verify what is actually inside your npm package, Docker image or release bundle, not just what your pipeline is supposed to include.
Treat source maps as source code
Strip or exclude them from production and public builds by default, and add an explicit check to your CI pipeline.
Add a release security checklist
Signing, permissions, artifact contents and post-publish verification should be required gates, not optional steps.
Assume anything downloadable will be mirrored at once
You can remove a version from a registry, as Anthropic did with 2.1.88, but not the copies people already made. Your incident response plan must account for this.
Invest in your product harness, not only the model
Memory design, orchestration and permissions are now where products differ, and they are also an operational risk.
How do you keep source maps out of an npm package?
Decide what goes into the package instead of what stays out, then look inside the package before every release. These checks take minutes and would have caught a stray map file:
- List what to publish in the
filesfield of package.json: npm treats it as an allow-list. - Remember that a root
.npmignorecannot override thefilesfield, so do not rely on it alone. - Turn off source maps in your bundler's production build, or keep them in a private location.
- Build the tarball with
npm packand list its contents before you publish. - Make CI fail when a
.mapfile or a source folder appears in the release artifact. - Check what a source map points to: in this case it led to a downloadable archive of the source.
Source: the npm documentation on the files field and npm pack.
How we sourced this article
This article draws on widely reported timelines and technical explanations from public channels. Where claims depend on third-party analysis of leaked artifacts, we treat them as reported or analyst-described, not as facts we have independently verified. Official statements may update the record.
Frequently asked questions
What happened in the Claude Code leak?
On March 31, 2026, Claude Code version 2.1.88 was published to npm with a source map that let people rebuild its TypeScript source, more than 512,000 lines. Anthropic called it a release packaging issue caused by human error and removed the version from npm.
Was the Claude Code leak a hack or a data breach?
No. Anthropic said it was "a release packaging issue caused by human error, not a security breach", and that no sensitive customer data or credentials were involved or exposed. What leaked was the source of the command-line tool.
Were Claude's model weights leaked?
No report says so. The source map covered the Claude Code command-line tool, which talks to Anthropic's models over the internet and does not contain them, so the npm package held no model weights to expose.
Was the Claude Code leak an April Fools' joke?
No. A screenshot titled "We Leaked Nothing" claimed Anthropic staged the leak, but Lead Stories rated it false on April 2, 2026: the leak was reported on March 31 and followed by a real GitHub takedown on April 1.
Which unreleased features did the leak reveal?
Developers reading the code reported feature flags such as KAIROS, an always-on assistant mode, a Tamagotchi-style companion called Buddy, and cross-session memory work. Anthropic has not announced these as products, so they may change or never ship.
Did Anthropic take the leaked code down from GitHub?
Yes. Its copyright notice on April 1, 2026 first reached about 8,100 repositories, including legitimate forks of Anthropic's own public repository. Anthropic called that an accident and limited the takedown to one repository and 96 forks containing the leaked code.
What should I check if I installed Claude Code on March 31, 2026?
Look for the trojanized axios versions 1.14.1 and 0.30.4 and the plain-crypto-js package in your lockfiles and node_modules, then update Claude Code. If either version is present, treat the machine as compromised and rotate your secrets.