Anthropic's Claude Code Source Leaks via npm, Revealing Profanity Logging and Sparking Instant Open-Source Forks
A source-map file left in Anthropic's npm registry exposed the entire Claude Code codebase. Within hours, the community had forked it, ported it to Python and Rust, and discovered that the tool silently logs profanity from user prompts to an internal database.
Anthropic's Claude Code — the company's flagship agentic coding tool — had its full source code exposed to the public through a source-map file accidentally published to the npm registry, as first reported by @Fried_rice. The leak, which went viral across developer communities on Tuesday, represents one of the most consequential accidental disclosures in recent AI tooling history, arriving at a particularly awkward moment for a company that has carefully guarded its intellectual property while positioning itself as the safety-first AI lab.
The exposure was discovered by a security researcher who noticed the .map file bundled with Claude Code's npm package, providing a full reconstruction path back to the original TypeScript source. @YahooFinance confirmed that the leak came through a standard source-map file — an artifact typically stripped before production deployment. The oversight is elementary by security standards, the kind of mistake that would fail a junior engineer's code review.
Get our free daily newsletter
Get this article free — plus the lead story every day — delivered to your inbox.
Want every article and the full archive? Upgrade anytime.
No spam. Unsubscribe anytime.