A packaging error in the Claude Code CLI tool exposed approximately 513,000 lines of unobfuscated TypeScript source code, contained in a 59.8 MB source map file. The code was mirrored to GitHub within hours and malicious actors immediately created fake repositories infected with malware targeting developers. Anthropic’s DMCA takedown requests disrupted approximately 8,100 repositories, many of which had no connection to the leak. The company confirmed this was human error rather than a security breach, and that no customer data or credentials were compromised. Crypto developers should audit their dependency chains and verify the provenance of recently cloned repositories.
Source: Read the original article
