Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-03-31 · source-backed
Security researcher Chaofan Shou discovered that Anthropic's Claude Code v2.1.88 npm package shipped with a 59.8MB source map file containing the full, unobfuscated TypeScript source. 1,902 files. 512,000 lines. 35 build-time feature flags for unreleased capabilities. 49 agent persona markdown files. The archived repo already has 1,100+ stars and 1,900+ forks.
The suspected cause is a Bun build bug that included source maps in the production bundle. A mundane build configuration error. But here's what makes this genuinely interesting: the source map was present for 13 months before anyone noticed. That's not a sophisticated attack. That's npm's default behavior serving whatever's in the package to anyone who asks.
What the community found inside is more revealing than the leak itself. KAIROS is an "Always-On Claude" mode, a persistent assistant that works across sessions with nightly "dreaming" passes. BUDDY is a Tamagotchi-style ASCII pet in the input UI. There's an "Undercover Mode" that strips Anthropic-internal information from commits when employees contribute to public repos, with instructions to "write commit messages as a human developer would." A regex-based frustration detection system matches words like "wtf" and "broken" for telemetry.
But the real architectural revelation: Anthropic builds Claude Code using Claude Code. The agents/ directory contains 49 markdown files, personality profiles for specialized AI personas including harness, plan, security, and explore agents. This is recursive self-improvement at the tool level: the agents that power the coding tool are defined as markdown specs that Claude Code can read and iterate on.
Multiple GitHub repos mirroring or rewriting the leaked source got hit with Anthropic DMCA takedowns within hours. But the architectural blueprint is out. The CLAUDE.md-as-architecture pattern, where agent behavior is defined in markdown files that both humans and AI can read, is now validated by the biggest AI coding tool on the market.
The irony of today's two npm stories is perfect. axios failed because npm is too trusting: stolen credentials publish arbitrary code. Claude Code failed because npm is too transparent: build artifacts that should never ship get served to anyone. paddo.dev's analysis nailed it: "npm had a very bad day," and neither incident required anything sophisticated.
Each link below shares sources, entities, or timing with this story.
Anthropic released Claude Code / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Anthropic released Claude Code); both cover Anthropic, Claude Code, ClaudeAI, There; reported by the same outlet (paddo.dev, reddit.com).
Linked by a graph relationship (Anthropic released Claude Code); both cover Always, Anthropic, Claude Code, ClaudeAI; reported by the same outlet (reddit.com).
Linked by a graph relationship (Anthropic released Claude Code); both cover Anthropic, Claude Code, TypeScript; reported by the same outlet (paddo.dev, reddit.com).
Codex competes with Claude Code / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Codex competes with Claude Code); both cover Anthropic, Claude Code, TypeScript; overlapping topics (agent, anthropic, claude, code, coding).
Anthropic released Claude Code / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Anthropic released Claude Code); both cover Anthropic, Claude Code, There, TypeScript; overlapping topics (agent, anthropic, claude, code).
Codex competes with Claude Code / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Codex competes with Claude Code); both cover Anthropic, Claude Code, ClaudeAI; reported by the same outlet (reddit.com).
Claude Code uses LSP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Claude Code uses LSP); both cover Claude Code, KAIROS, TypeScript; overlapping topics (agent, claude, code, coding, tool).
Codex competes with Claude Code / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Codex competes with Claude Code); both cover Anthropic, Claude Code, ClaudeAI; reported by the same outlet (reddit.com).