More than 513,000 lines of Anthropic's Claude Code were accidentally exposed due to a packaging error on March 31. The issue involved a 59.8 MB source map file included with version 2.1.88 of the Claude Code CLI tool, which should not have been released publicly. This file contained 1,906 internal TypeScript source code files, all in plain view.
The leak was not a hacking incident but a human mistake during the release process. Although Anthropic confirmed that no customer data or credentials were leaked, the aftermath was chaotic. Within hours, the entire codebase was mirrored on GitHub, spawning multiple forks and enticing malicious actors to create fake repositories embedded with malware.
Developers searching for the genuine code risked introducing compromised dependencies into their projects by cloning these counterfeit repositories. This situation is particularly troubling for crypto developers who rely on AI tools like Claude Code for their builds, given Anthropic's past funding ties with crypto firm FTX in 2022.
Anthropic's attempt to stem the damage through DMCA takedown requests backfired, disrupting around 8,100 GitHub repositories, many unrelated to the leak. The cleanup only added confusion and delayed recovery.
The incident also sparked rumors around unreleased models like "Claude Mythos" and raised concerns about the quality of Claude Code outputs, which reportedly worsened in April 2026. For crypto builders, auditing dependencies has become a critical step in safeguarding their projects from these malware campaigns.
