Claude Code's Entire Source Code Just Leaked via npm — 512,000 Lines Exposing Fake Tools, Frustration Detection, and Undercover Mode

Anthropic shipped a source map file in version 2.1.88 of the @anthropic-ai/claude-code npm package. That map file referenced a zip archive hosted on a publicly accessible Cloudflare R2 bucket. Inside: 1,900 TypeScript files, 512,000 lines of code — the entire Claude Code codebase, readable, unobfuscated.

Security researcher Chaofan Shou spotted it first. Within hours, the code was mirrored across GitHub and forked over 41,500 times. Anthropic can request takedowns. The internet has already moved on.

This is Anthropic’s second major security lapse in five days, following the accidental exposure of internal documents detailing their unreleased Mythos model on March 26.

How it happened

Claude Code is built with Bun, which generates source maps by default unless explicitly disabled. Someone forgot to add *.map to .npmignore or configure the bundler to skip source map generation for production builds. A single misconfiguration. The map file was 59.8 megabytes.

Anthropic called it “a release packaging issue caused by human error, not a security breach.” No customer data or credentials were exposed. But the entire agentic harness — the code that tells Claude how to use tools, enforce guardrails, and coordinate multi-agent workflows — is now public.

What the code reveals

The codebase runs on Bun (not Node.js) and uses React with Ink for terminal UI rendering. The architecture includes roughly 40 permission-gated tools, a 46,000-line query engine handling all LLM API calls, and a multi-agent orchestration system that spawns isolated sub-agents for parallelizable tasks.

Here are the most notable findings:

Fake tools and anti-distillation. Claude Code injects decoy tool definitions into system prompts to poison training data for competitors recording API traffic. The feature is gated behind a GrowthBook flag (tengu_anti_distill_fake_tool_injection) and only activates for first-party CLI sessions. A second mechanism summarizes assistant reasoning with cryptographic signatures, hiding the full chain-of-thought from external observers. Both can be bypassed — a MITM proxy stripping the anti_distillation field defeats the first; setting CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS kills both.

Frustration detection. A regex in userPromptKeywords.ts scans user messages for profanity and frustration signals — variations of common expletives, “so frustrating,” “this sucks,” and similar phrases. Faster and cheaper than running inference for basic sentiment classification, but striking to see hardcoded in an LLM product.

Undercover mode. The undercover.ts module strips all Anthropic internal references when operating in external repositories. It suppresses mentions of codenames like “Capybara” and “Tengu,” Slack channels, internal repo names, and “Claude Code” itself. The source comments state there is “NO force-OFF” — only force-ON via an environment variable. AI-authored commits from Anthropic employees in open-source projects carry zero disclosure of AI authorship.

Native client attestation. API requests include a placeholder hash that Bun’s native Zig-based HTTP stack replaces with a computed value before transmission. The server validates this to cryptographically verify requests come from legitimate Claude Code binaries — a DRM-like mechanism operating below the JavaScript runtime, invisible to all JS-layer inspection.

KAIROS autonomous agent. Feature-gated scaffolding for an unreleased always-on agent mode, including a /dream skill for “nightly memory distillation,” daily append-only logs, GitHub webhook subscriptions, background daemon workers, and 5-minute cron-scheduled refresh cycles. The infrastructure for persistent background agents exists in the codebase.

Bash security. Every shell command runs through 23 numbered security checks: 18 blocked Zsh builtins, defenses against Zsh equals expansion (=curl bypassing permission checks), zero-width space injection, and IFS null-byte injection — vulnerabilities discovered during HackerOne review.

Resource waste. A comment in autoCompact.ts notes that as of March 10, 2026, “1,279 sessions had 50+ consecutive failures (up to 3,272) in a single session, wasting ~250K API calls/day globally.” The fix was capping consecutive failures at 3.

Code quality. print.ts spans 5,594 lines with a single 3,167-line function nested 12 levels deep. The codebase also uses Axios for HTTP requests — the same library that was backdoored in a supply chain attack earlier today.

What this means

The harness code is the competitive moat. It encodes years of decisions about how to make an AI agent reliable — permission systems, tool orchestration, prompt caching economics, security guardrails. Competitors now have a complete reference implementation to study.

For Anthropic, two accidental exposures in one week — first Mythos, now the full source — raises questions about internal build and release processes. The fix for source map leaks is trivial. The reputational cost of shipping it twice is not.

The code is already being used. Multiple open-source projects are rebuilding Claude Code’s architecture in Rust and other languages, with full documentation of every undisclosed feature. The genie is not going back in the bottle.