Claude Code Source Exposed Through npm Package Debug Files
Summary
A debug source map in Anthropic’s Claude Code 2.1.88 npm package reportedly exposed about 1,900 files and 512,000 lines. The article describes the agent’s permissions and guardrails, ways to loosen them, and concerns about community mirrors.
Key points
- The article reports that a roughly 59.8 MB debug source map was mistakenly included in the public @anthropic-ai/claude-code 2.1.88 npm release.
- The exposed source reportedly comprised about 1,900 files and more than 512,000 lines, including large modules such as QueryEngine.ts and Tool.ts.
- Claude Code’s QueryEngine handles streaming responses, tool-call loops, retries, token counting, prompt assembly, and permission checks.
- The article describes six permission modes, including a full-bypass mode, and says code or configuration changes can loosen guardrails through mode switching, pre-approving tools, or changing system prompts.
- Community mirrors and reimplementations appeared after the leak; the article cites instructkr/claw-code as one example.
- The article warns that exposed implementation details could help attackers craft targeted malicious repositories, and raises concerns about tampered dependencies in unofficial mirrors.
Article Details
- Event Type
- Accidental exposure of Claude Code source code through debug source-map files included in the public npm release of @anthropic-ai/claude-code 2.1.88.
- Impact
- The exposure revealed approximately 1,900 files and more than 512,000 lines of source code, including implementation details of permissions and guardrails. The article says this could help malicious actors weaken safeguards or craft targeted malicious repositories; it also reports rapid community mirroring and reimplementations. It does not report confirmed malicious exploitation.
MITRE ATT&CK
T1005 · Data from Local SystemClaude Code can read local project files, creating a potential local-data access path if its guardrails are bypassed.T1059 · Command and Scripting InterpreterClaude Code can execute shell commands; the article says this capability could be abused if its guardrails are removed.