Then, on March 31, 2026, Anthropic accidentally shipped a debugging file inside a routine npm package update — version 2.1.88 of the
@anthropic-ai/claude-code package. The file was a JavaScript source map, intended only for internal use. It contained 512,000 lines of TypeScript source code: Claude Code's full client-side runtime, all 40+ tool definitions, the permission logic, and a 57,000-word system prompt. Everything Anthropic had built around the model, exposed.