Anthropic
Disclosed Mar 31, 20265 months agoUnverified
Claude Code source code accidentally published in npm package
Anthropic briefly published Claude Code version 2.1.88 to npm with a 60MB source map that contained the tool's closed source code, which spread widely on GitHub. Anthropic called it a packaging error and said no customer data or credentials were exposed.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Mar 31, 2026 |
| Discovered | Mar 31, 2026 |
| Attack | Exposed data |
| Data exposed | Source code |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
| Source | |
|---|---|
| Claude Code source code accidentally leaked in NPM packagebleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Mar 31 |
Other breaches at Anthropic
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Infostealer-stolen session cookies used to hijack Claude accountsAug 313 weeks agoHackingUnverified | Aug 313 weeks ago | Hacking | AI | Unverified | Unknown |
| Shared Claude conversations appeared in Google search resultsJul 272 months agoExposed dataUnverified | Jul 272 months ago | Exposed data | AI | Unverified | Unknown |
| DeepSeek, Moonshot and MiniMax used 24,000 fraudulent accounts to distill ClaudeFeb 237 months agoAI or model | Feb 237 months ago | AI or model | AI | Confirmed | Unknown |
| Chinese state group manipulated Claude Code to attack about 30 organizationsNov 13, 202510 months agoHacking | Nov 13, 202510 months ago | Hacking | AI | Confirmed | Unknown |
| Cybercriminal used Claude Code to steal and extort data from at least 17 organizationsAug 27, 20251 year agoExtortion | Aug 27, 20251 year ago | Extortion | AI | Confirmed | Unknown |
| Contractor mistakenly emailed file of customer names and credit balances to third partyJan 29, 20242 years agoInsiderUnverified | Jan 29, 20242 years ago | Insider | AI | Unverified | Unknown |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.