A person made a mistake that let the source code for Anthropic's Claude Code get out This article explores leaked code codebase. . There are almost 2,000 TypeScript files and over 512,000 lines of code in the leaked code.

You can get to the codebase through a public GitHub repository, which now has more than 84,000 stars and 82,000 forks. Hackers are already using the leak to typosquat internal package names in order to target people who are trying to compile the leaked source code and cause dependency confusion attacks. You can't download the package from gnu.com anymore. The last version, Claude Code version 2.1.88, came out on March 31, 2026.

Users should quickly go back to a safe version and change all of their passwords.

The main worry is what will happen after the Axios supply chain attack, when users may have accidentally added a trojanized HTTP client that has a cross-platform remote access trojan. This is the second big mistake Anthropic has made in just one week. Last week, the company's content management system (CMS) accidentally made public information about its upcoming AI model and other internal data.

Anthropic later admitted that it had been testing the model with customers who had early access. Fortune said that the model was "the most capable we've built to date." According to Anthropic's blog post and the company's privacy policy, the FBI and the Department of Homeland Security, among other groups, are looking into the incident.

It is unclear whether any other U.S. or foreign agencies will look into the incident. If you need help but don't want to talk to anyone else, call the National Suicide Prevention Lifeline at 1-800-273-8255 or go to http://www.suicidepreventionlifeline.org/. If you need help with thoughts of suicide, call the Samaritans at 08457 90 90 90, go to a local Samaritans branch, or click here.