Claude Code Source Code Leaked via npm Source Map — 1,900 Files, 512K Lines, 35 Build-Time Feature Flags Exposed

Hacker News / Chaofan Shou·high signal

Security researcher Chaofan Shou discovered that Anthropic's v2.1.88 npm package included a 59.8MB source map file (cli.js.map) containing the full unobfuscated TypeScript source. The leak exposed 1,902 source files, 35 compile-time feature flags for unreleased capabilities, 49 agent persona markdown files, and internal model codenames. The archived repo already has 1,100+ stars and 1,900+ forks — a Bun build bug is suspected of causing the source maps to ship.