Anthropic Leaks Claude Code Source via NPM .map File
Developer spotted unintended .map file in Claude Code NPM package, exposing 512k lines of TypeScript source including secret Tamagotchi 'Buddy' for April Fools'. Human error spoiled the launch surprise—no customer data affected.
This brief news article details a publishing mishap in Anthropic's Claude Code NPM package. On March 31, 2026, developer Chaofan Shou discovered a source map (.map) file that revealed approximately 512,000 lines of internal TypeScript codebase, publicly accessible to anyone inspecting the package.
Hidden Easter Egg Uncovered
The leak exposed 'Buddy,' a complete Tamagotchi-style companion feature codenamed for an April 1 launch as a delight for users. Typing /buddy would activate it, but the source code preview ruined the surprise. Anthropic confirmed it as human error during packaging—no customer data leaked, only engineering code.
Impact on Launch
The rainbow notification for /buddy rolled out on schedule, but developers had already dissected the full codebase. This undercut the engineering effort's punchline, highlighting risks of source maps in NPM publishes for AI tools like Claude Code.