Claude Code's Entire Source Code Leaked via npm, and What's Inside Is More Interesting Than the Leak Itself

Security researcher Chaofan Shou discovered that Anthropic's Claude Code v2.1.88 npm package shipped with a 59.8MB source map file containing the full, unobfuscated TypeScript source. 1,902 files. 512,000 lines. 35 build-time feature flags for unreleased capabilities. 49 agent persona markdown files. The archived repo already has 1,100+ stars and 1,900+ forks.

The suspected cause is a Bun build bug that included source maps in the production bundle. A mundane build configuration error. But here's what makes this genuinely interesting: the source map was present for 13 months before anyone noticed. That's not a sophisticated attack. That's npm's default behavior serving whatever's in the package to anyone who asks.

What the community found inside is more revealing than the leak itself. KAIROS is an "Always-On Claude" mode, a persistent assistant that works across sessions with nightly "dreaming" passes. BUDDY is a Tamagotchi-style ASCII pet in the input UI. There's an "Undercover Mode" that strips Anthropic-internal information from commits when employees contribute to public repos, with instructions to "write commit messages as a human developer would." A regex-based frustration detection system matches words like "wtf" and "broken" for telemetry.

But the real architectural revelation: Anthropic builds Claude Code using Claude Code. The agents/ directory contains 49 markdown files, personality profiles for specialized AI personas including harness, plan, security, and explore agents. This is recursive self-improvement at the tool level: the agents that power the coding tool are defined as markdown specs that Claude Code can read and iterate on.

Multiple GitHub repos mirroring or rewriting the leaked source got hit with Anthropic DMCA takedowns within hours. But the architectural blueprint is out. The CLAUDE.md-as-architecture pattern, where agent behavior is defined in markdown files that both humans and AI can read, is now validated by the biggest AI coding tool on the market.

The irony of today's two npm stories is perfect. axios failed because npm is too trusting: stolen credentials publish arbitrary code. Claude Code failed because npm is too transparent: build artifacts that should never ship get served to anyone. paddo.dev's analysis nailed it: "npm had a very bad day," and neither incident required anything sophisticated.