Claude Code Source Map Leak (March 2026): 513K Lines Exposed via npm Source Map, Followed by DMCA Overreach

On March 31, 2026 a routine release of the npm package `@anthropic-ai/claude-code` (version 2.1.88) shipped with an unintended payload: a 59.8 MB JavaScript source map (`.map`) file. Source maps reconstruct the original TypeScript from minified bundles so developers can debug. The leaked map contained roughly 513,000 lines of unobfuscated source across 1,906 files — effectively the entire Claude Code client implementation. The immediate cause was a packaging miss. Bun's default build configuration generates source maps, and the `.map` file was not added to the project's `.npmignore`, so it was included in the published tarball. Within hours of release, copies were downloaded, archived, and re-uploaded to GitHub, where the repository was reportedly forked more than 41,500 times before any takedown attempt. Anthropic's response was to file DMCA takedown notices against approximately 8,100 GitHub repositories. The notices were broad enough to hit not just the direct leak mirrors but legitimate unrelated forks of public Anthropic projects. After public criticism Anthropic acknowledged the overreach was unintentional and rolled the takedowns back, but the affected repositories were unavailable in the interim. A secondary finding from inspecting the leaked source: it contains comments and code references citing OpenCode as a reference implementation for behaviors like terminal autoscroll and window-sizing logic. Anthropic was therefore reading OpenCode's source as a UX reference while concurrently sending OpenCode legal threats over subscription-token use — a coincidence critics found difficult to characterize charitably.