On March 31, 2026, security researcher Chaofan Shou discovered that the source map files in the Claude Code package published by Anthropic to npm were not stripped. This means: The complete TypeScript source code of Claude Code, 512,000 lines, 1903 files, was exposed on the public internet just like