The exposure traces back to version 2.1.88 of the @anthropic-ai/claude-code package on npm, which was published with a 59.8MB JavaScript source map intended only for internal debugging. The map file enabled the reconstruction of roughly 512,000 lines of TypeScript code powering Claude Code’s orchestration layer and CLI. Within hours of…
