Security brief

Claude Code packaging error exposed source files, according to Anthropic

REVIEW

The company described an accidental source-map release and said customer data and credentials were not exposed.

Published 29 Oct 2026 · Material update 1 Apr 2026 — last time the underlying evidence changed · Evidence: medium

What happened

Anthropic confirmed that a packaging mistake in Claude Code’s npm release exposed internal source code, according to April 2026 reporting. A source-map file in version 2.1.88 pointed to files that were quickly copied elsewhere.

The company said no sensitive customer information or credentials were involved. The source exposure was not equivalent to releasing model weights, training data or every part of Anthropic’s service infrastructure.

Developers should obtain updates through official distribution channels and avoid unofficial repackaged copies. Release teams should inspect published artifacts, including source maps, rather than assuming a successful build contains only intended public files.

Read the original source.

Next step

Use official packages and review release artifacts for unintended internal files.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references