Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms

Anthropic confirmed that internal source code for Claude Code was accidentally leaked via an npm packaging error in version 2.1.88, exposing nearly 2,000 TypeScript files and over 512,000 lines of code.

• •The leak was caused by a source map file included in the npm package, not a security breach; no customer data or credentials were exposed.
• •Revealed internals include a tools system, query engine, multi-agent orchestration, a KAIROS background agent feature, and a "dream" mode for continuous background thinking.
• •An "Undercover Mode" was exposed that instructs Claude Code to make stealth contributions to open-source repositories without revealing Anthropic-internal information in commits or PRs.
• •A separate supply chain attack via a trojanized Axios version was distributed through npm on March 31, 2026; affected users are advised to downgrade and rotate secrets.