Source Map Leak (March 31, 2026)
- Entity ID:
ent-20260410-0679b2cd1ee4 - Type:
issue - Scope:
shared - Status:
active - Aliases: source-leak, npm-leak, source-map-leak
Description
Claude Code v2.1.88 shipped with npm source map exposing the full 512,000-line TypeScript codebase. The most significant accidental source exposure in AI tool history.
Key claims
clm-20260419-270ad058d737: Core productive TypeScript is 64,464 lines, not 512,000clm-20260419-45bcf3591813: The leak shortened time-to-copy from unknowable to 'read and ship'clm-20260419-5eaa8c49e128: March 31 npm install window overlapped with live Axios RATclm-20260419-a001c23d0017: Peers and Touchpoint Represent Post-Leak Community Accelerationclm-20260419-a0b1c2d3e4f0: Claude Code was leaked by Anthropic's own acquired runtimeclm-20260419-a0b1c2d3e4fa: Two unrelated supply-chain events overlapped in an 88-minute window on March 31clm-20260419-a101d2e3f4a5: Three leak vectors rule out single-misconfiguration explanationclm-20260419-a103f4a5b6c7: 363 package versions shipped between leaks 1 and 3clm-20260419-b1c2d3e4f5a1: Two-factor failure: either defense alone would have prevented the leakclm-20260419-d09b042b6ab5: Codename-leak-prevention code shipped inside the package that leaked everythingclm-20260419-d34c5a2623e1: Zero test files in the leaked codebaseclm-20260419-e9098fbdbb24: Security-control scoping must match the threat vectors it claims to coverclm-20260419-g1a0000000cb: OpenBSD patched the 27-year TCP SACK bug six days before the npm leak
Relations
rel-20260419-00000000a026: NodexisLabs Authorship Analysis --[summarizes]--> Source Map Leak (March 31, 2026)rel-20260419-0001: Source Map Leak (March 31, 2026) --[caused]--> Bun Bug #28001rel-20260419-0002: Source Map Leak (March 31, 2026) --[caused]--> Missing .npmignore Source Map Rulerel-20260419-0018: Chaofan Shou (@Fried_rice) --[related_to]--> Source Map Leak (March 31, 2026)rel-20260419-a1b2c3d4e714: Anthropic IPO Timeline (Q4 2026) --[informed_by]--> Source Map Leak (March 31, 2026)rel-20260419-a550cd44fd80: AI-Authorship Percentage Escalation --[contradicts]--> Source Map Leak (March 31, 2026)rel-20260419-a6ef7f59a5f8: Bash Bypass Wave (8 fixes) --[derived_from]--> Source Map Leak (March 31, 2026)rel-20260419-b003c3d4e5f6: Three-Vector Leak Pattern --[contains]--> Source Map Leak (March 31, 2026)rel-20260419-c88f2aedd9e7b: Victor Antos Self-Referential Analysis --[derived_from]--> Source Map Leak (March 31, 2026)rel-20260419-dc24bd7e8384: Supply Chain Cascade Timeline (March 24 - April 3) --[contains]--> Source Map Leak (March 31, 2026)rel-20260419-deepcovers001: deep-dive-claude-code.vercel.app --[derived_from]--> Source Map Leak (March 31, 2026)rel-20260419-g1a0000000f3: Project Glasswing --[related_to]--> Source Map Leak (March 31, 2026)