A significant security oversight has led to the exposure of the full source code for Claude Code, the CLI tool by Anthropic. The leak occurred due to the accidental inclusion of a source map (.map) file within the package distributed on NPM.
Source maps are intended to help developers debug minified code by mapping it back to its original, human-readable format. In this case, the file allowed researchers to reconstruct the entire project base. Security researcher realsigridjin discovered the leak and ported the original TypeScript code to Python for legal reasons.
The reconstructed source code is currently hosted on GitHub in the instructkr/claude-code repository. This incident highlights the critical importance of sanitizing deployment packages to prevent sensitive code exposure.
