Anthropic accidentally exposed Claude Code source, raising security concerns

Anthropic's @anthropic-ai/claude-code npm package v2.1.88 briefly published a 59.8MB JavaScript source map intended for internal debugging.

The source map enabled reconstruction of roughly 512,000 lines of TypeScript powering Claude Code's orchestration layer and CLI.

Reconstructed repositories and mirrors appeared on GitHub within hours of the release.

Exposed files include references such as a KAIROS feature flag (150+ mentions) for an always-on daemon mode and a MEMORY.md describing a layered memory system and index of pointers.

Anthropic said the exposure was due to a packaging failure, not a security breach, and the incident coincided with a separate Axios supply-chain compromise.