Claude Code npm package leaks source map

Hot take: this is a serious release hygiene failure, but it is not the same as a model breach.

• –The exposure is tied to the Claude Code npm package, which makes this a developer-tool security incident rather than a core model compromise.
• –Shipping source maps can make a minified CLI effectively transparent, which lowers the effort needed to inspect logic, telemetry, flags, and internal implementation details.
• –If the report is confirmed, the practical fallout is likely embarrassment, easier cloning/reverse engineering, and a cleanup rush in the release pipeline.
• –The main fix is straightforward: strip source maps from published artifacts, audit the npm package contents, and document the release controls that failed.