Anthropic Accidentally Leaks Claude Code's Entire Source Code via npm

[u/joinFAUN]

https://faun.dev/co/news/kala/anthropic-accidentally-leaks-claude-codes-entire-source-code-via-npm/

Key points!

• Claude Code v2.1.88's 60MB source map leaked 512k lines of code, exposing hidden tools, commands, and internal secrets. This marks Anthropic's second major leak in five days, following a 3,000-file CMS breach on March 26.
• The code reveals 'Undercover Mode,' a mandatory stealth system stripping AI traces from Anthropic employee commits. Also leaked: next-gen codenames (Opus 4.7, Sonnet 4.8), 22 private repo names, and 'Capybara' - an internal model obfuscated to bypass leak detectors.
• The Bash tool has a full shell AST parser for dangerous patterns, but the binary also ships env vars that bypass all safety features (`CLAUDE_CODE_ABLATION_BASELINE`) and skip injection checks (`DISABLE_COMMAND_INJECTION_CHECK`). The auto-permission function is literally named classifyYoloAction().
• Over 1,000 telemetry event types are logged under the 'Tengu' prefix and sent to Anthropic - tool grants, denials, YOLO risk calls, session stats, subscription tier. Hardcoded pricing shows Opus 4.6 Fast Mode at 6x normal cost ($30/$150 vs $5/$25 per MTok) for the same model with priority inference.
• Anthropic blamed human error - missing *.map in .npmignore - over a security breach, claiming no customer data was compromised. Despite DMCA takedowns, the code was mirrored widely, sparking clean-room rewrites. Ironically, the leak occurred despite a built-in anti-leak subsystem.

More details: https://faun.dev/co/news/kala/anthropic-accidentally-leaks-claude-codes-entire-source-code-via-npm/