I Analyzed All 512,000 Lines of Claude Code's Leaked Source — Here's What Anthropic Was Hiding

On March 31st, 2026, security researcher Chaofan Shou -- an intern at blockchain security firm Fuzzland -- discovered something Anthropic probably didn't plan on sharing with the world: the entire source code of Claude Code, shipped as a sourcemap file inside the npm package. A 59.8 MB .map file in @anthropic-ai/claude-code version 2.1.88 -- a standard build artifact that maps minified code back to original source -- contained every TypeScript file, every internal prompt, every feature flag, and every codename. The file pointed to a zip archive hosted on Anthropic's Cloudflare R2 storage bucket that anyone could download and decompress. This is the second time this has happened. In February 2025, an early version of Claude Code had the exact same issue, forcing Anthropic to pull the package from npm. Sixteen months later, same mistake, same vector -- but this time the product is far more mature and the stakes are far higher. Within hours, the 512,000-line TypeScript codebase was mirror