Anthropic Accidentally Leaks Claude Code’s “Secret Sauce” via npm Blunder

Anthropic’s Claude Code source was exposed after developers accidentally published source maps to its public npm registry, allowing anyone to reconstruct the original TypeScript source. The leak revealed core internals—like the 46,000-line QueryEngine.ts, 40+ agent tools, the permission system, and unreleased feature flags—and although Anthropic secured the registry, copies are already circulating. #Anthropic #ClaudeCode

Keypoints

Source map publication in the npm registry allowed reconstruction of the original TypeScript source.
QueryEngine.ts (~46,000 lines) manages LLM calls, thinking modes, retry logic, and token counting.
Implementations for over 40 agent tools, including BashTool, FileEditTool, and AgentTool, were exposed.
The permission system and build-time feature flags (VOICE_MODE, PROACTIVE, KAIROS, BRIDGE_MODE) reveal unreleased capabilities.
Anthropic secured the registry, but reconstructed repositories are already being hosted publicly, exposing intellectual property.