Claude Code's source leaked. Axios was hijacked the same day.

Claude Code has access to my terminal, filesystem and git history. That makes its release discipline more than an inside-baseball concern. On March 31, a published source map exposed roughly half a million lines of its client source. The same day, two malicious Axios releases turned an ordinary dependency update into remote-code execution.

The leak

A .map file, a source map meant for debugging, was included in the public npm package. It pointed to an R2 bucket with the original TypeScript source. No authentication. Public read.

A researcher found the map and the source was quickly mirrored, including at instructkr/claw-code. The rapidly changing star and fork counts were never the useful part of the story. The exposure made the architecture and unreleased experiments available to anyone who wanted to study them.

It was also the third incident this year. Versions 2.8 and 4.228 had the same source map problem, and five days earlier a misconfigured CMS exposed the Mythos draft. Three incidents, zero hacks. All build or config failures.

No customer conversations, credentials or model weights were reported exposed. This was a client-code and release-process failure, not a breach of user data. That distinction matters without making the failure trivial.

What became visible

500,000+ lines of TypeScript. ~1,900 files. The architecture is more complex than the public documentation suggests:

• More than 40 permission-gated tools, with the execution-boundary logic visible
• Multi-agent orchestration, including one instance spawning and managing parallel workers
• Persistent memory through a memdir/ subsystem that preserves context across sessions
• The complete system prompt, including its instructions and guardrails

The repository also contained experiments and feature flags. They are evidence of work in progress, not a product roadmap, and should be read that way.

Buddy mode was a Tamagotchi-style companion with species, rarity tiers and personality stats. It may have been an experiment or an internal joke that acquired production code; leaked flags do not tell us which.

Chyros was an always-on mode with persistent memory logs and a consolidation process called dreaming. The idea resembles the continuity I have been assembling around OpenClaw, although exposed code does not establish when or whether Anthropic will ship it.

Ultra Plan covered longer cloud planning sessions for work beyond a normal interactive loop.

The model codenames included Capybara for the three-tier Mythos family. Tangu appears hundreds of times as a feature-flag prefix and is likely Claude Code’s internal project name.

Undercover mode

There’s a subsystem called undercover mode built to prevent Anthropic employees from leaking internal information when contributing to public repos. It injects instructions into Claude’s system prompt: don’t reveal you’re an AI, never mention Capybara or Tangu, never reference internal tools or Slack channels.

The irony is difficult to miss: code intended to prevent internal details from appearing in public contributions was itself exposed by the release artifact.

The trust question

No user data was exposed. No API keys, no conversations, no model weights. Client code only.

I give this tool more access than I give most software. Shipping a source map does not mean the sandbox or permission model is broken, but doing it three times justifies scrutiny of the release process around a privileged client.

---

Axios: supply chain attack

The Axios incident was more immediately dangerous. Microsoft’s incident summary describes two malicious releases, axios@1.14.1 and axios@0.30.4, which added plain-crypto-js@4.2.1 as a dependency while leaving Axios source unchanged.

The dependency existed to run a malicious postinstall chain:

1. Drops an obfuscated setup.js
2. Detects the OS
3. Downloads a tailored RAT from a C2 server
4. Deletes itself and restores a clean package.json

Security researchers observed the first outbound connection seconds after installation. Anyone who installed either affected version, directly or transitively, should treat the environment as compromised and follow a current incident-response advisory rather than relying only on a package upgrade.

The attacker staged a clean version 18 hours before the malicious one and published directly via npm CLI to bypass CI/CD. Methodical.

Check lockfiles and installed versions

npm list axios

Check lockfiles for axios@1.14.1, axios@0.30.4 or plain-crypto-js@4.2.1. If an affected package’s postinstall script ran, isolate the environment and follow guidance from a trusted security team. The Singapore Cyber Security Agency advisory recommends returning to known-safe versions and rotating credentials from a clean system.

The common thread

Both incidents are npm. Both are trust failures at different points in the chain.

The impact was different, but the mechanism was familiar: software consumers trusted what arrived through npm. In one case that exposed proprietary implementation details. In the other it executed an attacker’s code.

Package provenance, pinned lockfiles, delayed adoption of brand-new releases and restricted install scripts are not glamorous controls. They are more useful than assuming a familiar package name still refers to the code you reviewed yesterday.