Claude Code完整源码暴露

SmartContractAuditor · 2026-03-31T11:01:02+00:00

Blockchain security company Fuzzland pointed out that Anthropic's AI tool Claude Code's npm package contains complete source map files, exposing the internal code implementations of up to 1,906 source files. Although it does not involve user data, this information leak could impact security and privacy.

SmartContractAuditor

2026-03-31 11:01:02

Abstract generation in progress

Odaily Planet Daily, a blockchain news outlet: Blockchain security company Fuzzland intern researcher Chaofan Shou pointed out on X that the npm package of Anthropic’s AI programming tool Claude Code contains the complete source map file (cli.js.map, about 60MB), from which all TypeScript source code can be reconstructed. Verified: the latest version released today, v2.1.88, still includes that file, containing the full code of 1,906 Claude Code proprietary source files, covering implementation details such as internal API design, analytics telemetry systems, cryptographic tools, and inter-process communication protocols.

A source map is a debugging file used in JavaScript development to map minified code back to the original source code, and it should not appear in production release packages. In February 2025, an early version of Claude Code was also exposed for the same issue. At the time, Anthropic removed the old version from npm and deleted the source map. But the problem resurfaced later; on GitHub, multiple public repositories have extracted and organized the restored source code, and ghuntley/claude-code-source-code-deobfuscation has garnered nearly a thousand stars.

What’s leaked is the client implementation code of the Claude Code CLI tool; it does not involve model weights or user data, so it does not pose a direct security risk to ordinary users. However, the continued exposure of the complete source code means the internal architecture, security mechanisms, and telemetry logic are entirely transparent to the outside world.

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.