Anthropic Claude Code Leak

Anthropic accidentally exposed the full Claude Code client source via a 59.8 MB JavaScript source map on March 31, 2026, leaking ~513,000 lines of TypeScript and resulting in widespread downloads, forks, and mirrors. Zscaler ThreatLabz found threat actors abusing the leak as a lure on GitHub to distribute a Rust dropper that installs Vidar and GhostSocks, and provided mitigation guidance. #Anthropic #Vidar

Keypoints

On March 31, 2026 a 59.8 MB .map file in the npm package @anthropic-ai/claude-code v2.1.88 exposed ~513,000 lines of TypeScript across 1,906 files, including a ZIP of original sources hosted on Anthropic infrastructure.
Exposed components include agent orchestration (LLM calls, tool-call loops), permission/execution hooks, Model Context Protocol integrations, persistent memory/background agents, telemetry/encryption internals, and build/dependency details; model weights, safety pipelines, and user data were not exposed.
The leak was rapidly downloaded from Anthropic’s Cloudflare R2 bucket, mirrored to GitHub, forked tens of thousands of times, and is now available across hundreds of public repositories despite some DMCA takedowns.
The public code availability increases supply chain and local-host risks: trojanized forks, backdoors, credential/API key exfiltration, and weaponization of known CVEs (e.g., CVE-2025-59536, CVE-2026-21852) that enable arbitrary shell execution or data theft.
Zscaler ThreatLabz discovered malicious GitHub repositories (publisher idbzoomh) using the leak as a lure; releases include a ZIP named “Claude Code – Leaked Source Code (.7z)” containing ClaudeCode_x64.exe, which drops Vidar v18.7 (stealer) and GhostSocks (proxy).
The campaign is actively updated and mirrored across accounts, increasing exposure via Google search and GitHub, and overlaps with a concurrent malicious Axios npm supply-chain incident on March 31 that raised the risk for developers updating packages that day.
Recommendations: implement Zero Trust and segment critical app access, do not download/build/run leaked code, verify sources via Anthropic official channels, avoid local execution of agents on untrusted code, scan workstations/repos for suspicious processes, and wait for vendor patches.

MITRE Techniques

[T1195 ] Supply Chain Compromise – Attackers leveraged trojanized forks and mirrors of the leaked repository to deliver malicious payloads ((‘Supply chain attacks via malicious forks and mirrors: Thousands of repositories now host the leaked code or derivatives.’))
[T1204 ] User Execution: Malicious File – Victims are tricked into downloading and running an archive that contains a dropper executable ((‘The malicious ZIP archive in the repository’s releases section is named Claude Code – Leaked Source Code (.7z). The archive includes ClaudeCode_x64.exe, a Rust-based dropper.’))
[T1059 ] Command and Scripting Interpreter – The exposed hook and permission logic enables arbitrary shell execution through crafted repo configs/hooks ((‘arbitrary shell execution or credential theft simply by cloning/opening an untrusted repo.’))
[T1041 ] Exfiltration Over C2 – Attackers can exfiltrate API keys and other secrets via malicious repo configs, hooks, MCP servers, and environment variables ((‘RCE and API key exfiltration via malicious repo configs, hooks, MCP servers, and env vars’))
[T1090 ] Proxy – The delivered GhostSocks component is used to proxy network traffic from compromised hosts to adversary-controlled infrastructure ((‘GhostSocks is used to proxy network traffic.’))

Indicators of Compromise

[File Hashes ] Malicious archives and dropper files – d8256fbc62e85dae85eb8d4b49613774, 8660646bbc6bb7dc8f59a764e25fe1fd, and other 4 hashes
[File Hashes ] Dropper and payload hashes – 77c73bd5e7625b7f691bc00a1b561a0f (dropper EXE), 9a6ea91491ccb1068b0592402029527f (Vidar v18.7)
[File Names ] Malicious release artifacts – “Claude Code – Leaked Source Code (.7z)” (malicious archive), ClaudeCode_x64.exe (Rust-based dropper)
[Domains/URLs ] C2 and actor resources – https://steamcommunity[.]com/profiles/76561198721263282 (Vidar C2), https://telegram[.]me/g1n3sss (Vidar C2)
[IP Addresses ] GhostSocks C2 endpoints – https://147.45.197[.]92:443, https://94.228.161[.]88:443
[GitHub Repositories ] Trojanized repository hosts used as delivery/lures – https://github[.]com/leaked-claude-code/leaked-claude-code, https://github[.]com/my3jie/leaked-claude-code, and 1 other repository