In the wild
Realized harm
Claude Code source map shipped in npm v2.1.88, immediately followed by typosquatting of its internal dependencies
AIR-2026-0083 AIR record · 2026-03-anthropic-claude-code-source-leak
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach.thehackernews.com
The record
Disclosed
2026-04-01
Occurred
2026-03-31
Vendor
Anthropic
Product
@anthropic-ai/claude-code npm package v2.1.88
Risk domain
Tool misuse › Supply chain vulnerabilities
System type
Generative model
Who acted
Human acted on output (contested) — a leaked source map let humans typosquat deps that installers then pulled
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Accidental source map in published package then dependency confusion
Impact type
Ip disclosure, Malware distribution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
~512,000 lines of unobfuscated TypeScript across ~1,900 files publicly mirrored; five squatted internal dependency names registered on npm
Capability abused
Defense & remediation
Recorded defense
npm publishing pipeline
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Anthropic pulled the source map from subsequent releases
Taxonomy & references
Curator notes
A 59.8 MB JS source map was included in v2.1.88 on 2026-03-31. npm user pacifier136 then registered audio-capture-napi, color-diff-napi, image-processor-napi, modifiers-napi and url-handler-napi as empty stubs to squat Claude Code's internal dependency names. Reporting also states users who installed Claude Code between 00:21 and 03:29 UTC on 2026-03-31 may have pulled a trojanized Axios containing a cross-platform RAT - that Axios compromise was NOT independently verified here and deserves its own record.
Cite as
Enkrypt AI. "Claude Code source map shipped in npm v2.1.88, immediately followed by typosquatting of its internal dependencies". AIR, AIR-2026-0083. https://agentincident.vercel.app/i/AIR-2026-0083/ (accessed 2026-10-19).