Anthropic unintentionally exposed the source code for Claude Code, its AI product, through a public npm package. The leak, which includes sensitive architectural details, poses significant risks for users and gives competitors insights into its technology. Users are advised to take immediate security precautions due to potential vulnerabilities.

• A source map on public npm exposed ~512,000 lines of Claude Code's TypeScript source, discovered by an intern rather than Anthropic itself.
• The leak reveals unreleased internal architecture like "Self-Healing Memory," "Strict Write Discipline," and the always-on "KAIROS" background agent.
• Internal metrics show development problems including a high false claims rate, plus an "Undercover Mode" letting Claude Code contribute to open-source projects without disclosing its identity.
• Users who updated packages around the leak window face added risk from a separate, unrelated malicious attack on the axios package.