Llm Security ResearchFinding

Claude Code source leak via npm packaging error

March 31, 2026The Cyber Security Hub™, Omri Segev Moyal, Abhay Bhargav

Omri Segev Moyal, The Cyber Security Hub, and others say Anthropic accidentally shipped Claude Code source to npm mirrors due to a missing ignore file, triggering repo takedowns and follow-on reverse engineering of internals.

Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms
@AnthropicAI shipped Claude Code's entire source code to every npm mirror on the planet. Not through a breach. Through a missing .npmignore file.
Yesterday we saw the Claude Code blunder. Where someone has accidentally committed the entire src to npm for anyone to download, view and reconstruct.
Anthropic strikes back after the Claude Code leak, nuking 8,100 GitHub repos.
Anthropic's Boris Cherny confirms a "human error" leaked Claude Code's source via MAP files.
Program Change Controls? Ever heard of it?
Anthropic accidentally leaked 512,000+ lines of Claude Code, exposing internal features and AI architecture after a packaging error during an update that turned out to be a major blunder.
The Cyber Security Hub™
Omri Segev Moyal
Abhay Bhargav
Nicolas Krassas
Hackread.com
Gray Hats
pirate.moo
Grant Collins
Lu3ky13
Dr Gerhard Knecht, PhD
npm packageleakincident responseclaudegithubnpmclaude codeopen sourcenpm package

See what experts are saying right now

This finding is one of many signals tracked across Cyber Security. The live feed updates every few hours with new expert voices, debates, and emerging ideas.

← Back to Cyber Security