Claude Code source code reportedly leaked via NPM map file
According to a tweet from @Fried_rice, the source code for Claude Code appears to have been leaked via a map file in their NPM registry. The tweet links to a Hacker News discussion with 93 points and 35 comments, indicating significant developer interest in this security incident.
The original tweet URL is provided, but the fetched page content shows JavaScript is disabled or blocked, preventing access to the specific details of the leak. When JavaScript is disabled on X.com, the platform displays a message requesting users to enable JavaScript or switch to a supported browser.
This type of incident typically involves source map files that are accidentally included in production builds. Source maps are debugging tools that map minified/compiled code back to the original source code, and when published to public registries like NPM, they can expose proprietary code that developers intended to keep private.
For developers using AI coding agents, this incident highlights the importance of proper build configuration and deployment practices. Source maps should be excluded from production packages or published to private registries when they contain sensitive code.
The Hacker News discussion likely contains technical analysis of the specific files exposed, the extent of the leak, and potential security implications for Claude Code users. Developers interested in the technical details should check the HN thread for community analysis and discussion.
📖 Read the full source: HN AI Agents
👀 See Also
Claude Code VS Code Extension Leaks Selection State Across Closed Files and New Sessions
A bug in Claude Code's VS Code extension caches file selection state even after the file is closed, exposing sensitive data (e.g., Supabase service-role keys) to a brand new CLI session. Full repro steps and GitHub issue #58886.
AI Security Researchers: Your 0-Day Vulnerabilities May Leak via Data Opt-In Toggle
The 'Improve the model for everyone' toggle in LLM interfaces can automatically harvest deep red-teaming research, sending your vulnerability concepts to vendor safety teams and potentially to academic papers before you publish. Disable data sharing before conducting serious security research.
SCION: Switzerland's Secure Alternative to BGP Routing Protocol
SCION (Scalability, Control, and Isolation On Next-Generation Networks) is an internet routing architecture developed at ETH Zürich that replaces BGP's foundation with built-in security and multi-path routing. Unlike BGP patches like RPKI and BGPsec, SCION establishes tens or hundreds of parallel paths with millisecond rerouting when failures occur.
Endo Familiar: Object-Capability Sandbox for AI Agents
Endo Familiar implements object-capability security for AI agents: agents start with zero ambient authority, receive only explicit references to specific files or directories, and can derive narrower capabilities in sandboxed code.