‍#ClaudeCode500KCodeLeak On March 31, 2026, Anthropic unintentionally exposed over 512,000 lines of its proprietary TypeScript code to the public internet. The cause was not sophisticated. It was operational. A .map file — a debugging artifact used to reconstruct minified code — was not excluded via .npmignore during a routine update to the Claude Code npm package. In production environments, source maps are never shipped. This one was. The file was accessible through a Cloudflare R2 bucket link embedded in the package metadata. Within hours, security researcher Chaofan Shou identified and shared it. The post reached tens of millions. Thousands of developers forked the repository before takedown efforts began. By the time Anthropic removed thousands of copies from GitHub, the code had already been archived, mirrored, and distributed across jurisdictions beyond effective enforcement. At that point, containment was no longer possible.