2026 Anthropic Claude Code — CLI source exposed via npm source map (~512k LOC TypeScript)
Data compromised
Proprietary TypeScript CLI/client source (via source map); not a traditional consumer personal-data breach
Technical writeup
On March 31, 2026, developers and security analysts widely reported that the Claude Code CLI package on npm shipped with a published JavaScript source map (.map) that reconstructed a very large share of the product’s TypeScript source—on the order of ~512,000 lines across ~1,900 files in public summaries. The issue is generally described as an accidental publish (e.g., build tooling such as Bun emitting maps that were not stripped from the npm artifact) rather than unauthorized access to Anthropic’s customer databases. Mirrors and forks spread quickly; DMCA takedowns followed. The exposure is proprietary application source and internal implementation detail—not end-user PII or model weights. This is distinct from the separate late-March 2026 Sanity CMS misconfiguration (anthropic2026).
Root cause
Source map included in published npm package; failure to exclude *.map from release artifact