The March 31, 2026 Claude Code npm release unintentionally exposed its full TypeScript source via a .map file, revealing over 1,900 files and 510,000 lines, which disclosed internal architecture, hidden features, telemetry, and security vulnerabilities that the community has dissected in detail.
The article chronicles the March 31 2026 Claude Code source‑code leak caused by an exposed .map file in Anthropic's npm package, details the community’s rapid forking, a Korean developer’s Python rewrite using oh‑my‑codex, and provides a full technical overview of the CLI’s architecture, size, and related resources.
A massive source‑map mishap exposed over 1,900 files and 510,000 lines of Claude Code’s TypeScript implementation, revealing its React‑Ink UI, Bun runtime, a 40‑module toolbox, a 46k‑line QueryEngine, multi‑agent coordinator, hidden Kairos mode, Undercover mode, and even an embedded virtual pet system.
A massive leak of Anthropic’s Claude Code exposed over 1,900 files and 510,000 lines of TypeScript, revealing its React‑Ink UI, Bun runtime, extensive toolset, hidden Kairos mode, electronic pet system, and covert Undercover features, sparking worldwide developer frenzy and security concerns.
