Claude Code npm packaging error Vulnerability
Evidence indicates that Claude Code is affected by a security issue. Reported affected versions include 2.1.88. Exploitation evidence is classified as confirmed in the wild.
What Happened
Evidence indicates that Claude Code is affected by a security issue. Reported affected versions include 2.1.88. Exploitation evidence is classified as confirmed in the wild.
Why This Matters
Publisher reporting describes a security event affecting Claude. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.
Recommended Action
Confirm whether Claude is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.
Exposure
Exposure unknown
Apr 01, 2026 05:30
Exposure reason: This incident does not currently match a technology in My Interests.
Exploitation status: CONFIRMED_IN_THE_WILD
Affected versions: 2.1.88
Primary entities:
Timeline
-
Incident first seen
Apr 01, 2026 05:30BugSkan first recorded this incident.
-
Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms - The Hacker News
Apr 01, 2026 05:30thehackernews.com · Data Leak
Sources
thehackernews.com · Apr 01, 2026 05:30
The Claude Code source code was inadvertently leaked due to an npm packaging error, specifically exposing thousands of TypeScript files via a source map file in version 2.1.88. This leak directly enabled bad actors to bypass AI guardrails, conduct supply chain attacks via trojanized npm packages like Axios, and distribute malware such as Vidar Stealer through dependency confusion and fake GitHub repositories.
Open publisher sourceRelated Incidents
Other BugSkan incidents that share identifiers, products, or vendors with this report.
My Interests Match
Create an account to see which incidents overlap with your interests.