A 59.8 MB JavaScript source map file — a debugging artifact that translates compressed, minified code back into readable source — was accidentally bundled into version 2.1.88 of the @anthropic-ai/claude-code package on the public npm registry earlier today.  The irony is almost too neat: the same company that quietly engineered an "Undercover Mode" to make sure its AI never leaks internal codenames in public git commits just accidentally shipped its entire codebase to every developer with an internet connection. On March 31, 2026, Chaofan Shou posted publicly to X: "Claude code source code has been leaked via a map file in their npm registry!" The published package reportedly contained a source map file referencing the complete, unminified TypeScript source, which was directly downloadable as a ZIP archive from Anthropic's own R2 cloud storage bucket. That X thread has already crossed 3.1 million views. The leaked codebase was quickly archived to a public GitHub r…
