Claude Code's complete source code exposed.

Chaofan Shou, an intern researcher at blockchain security company Fuzzland, pointed out on X that Anthropic's AI programming tool Claude Code's npm package contains a complete source map file (cli.js.map, approximately 60MB), from which the entire TypeScript source code can be reconstructed. It has been verified that the latest version v2.1.88 released today still contains this file, containing the complete code of 1,906 Claude Code proprietary source files, covering implementation details such as internal API design, analysis of telemetry systems, encryption tools, and inter-process communication protocols. Source maps are debugging files used in JavaScript development to map compressed code back to the original source code and should not appear in production releases. In February 2025, an earlier version of Claude Code was exposed for the same issue, and Anthropic removed the older version from npm and deleted the source map at that time. However, the issue resurfaced, and several public repositories on GitHub extracted and organized the restored source code, with ghuntley/claude-code-source-code-deobfuscation receiving nearly a thousand stars. The leaked code is the client-side implementation of the Claude Code CLI tool, which does not involve model weights or user data and poses no direct security risk to ordinary users. However, the continued exposure of the complete source code means that the internal architecture, security mechanisms, and telemetry logic are completely transparent to the outside world.