On March 31, 2026, security researcher Chaofan Shou discovered something Anthropic probably didn't want the world to see: the entire source code of Claude Code — Anthropic's official AI coding CLI — sitting in plain sight on the npm registry via a .map file bundled into the published package.

The model wasn't leaked. The weights are safe. But...