Claude Code's Entire Source Code Was Just Leaked via npm Source Maps — Here's What's Inside

A security researcher discovered Anthropic's full CLI source code exposed through a source map file. 1,900 files. 512,000+ lines. Everything. If you work with AI-powered coding tools, today is one of those days you'll remember. On March 31, 2026, security researcher Chaofan Shou (@shoucccc) discovered that Anthropic's Claude Code — their flagship agentic CLI tool — had its entire source code exposed through a source map file published to the npm registry. The leaked codebase was quickly archived to a public GitHub repository, where it has already surpassed 1,100+ stars and 1,900+ forks. And what's inside is fascinating. Disclaimer: This article is written purely for educational and research purposes. All code referenced remains the intellectual property of Anthropic. I do not endorse, encourage, or condone the unauthorized distribution of proprietary software. The repository was publicly available at the time of writing, and the analysis here is based solely on that publicly accessible