Trending Now - Anthropic's DMCA Takedown Mistakenly Targets Valid Github Projects

WHO:

Ars Technica - Anthropic, a company focused on AI development.

VentureBeat - Chaofan Shou, a security researcher who discovered the leak.

VentureBeat - Elia Zaitsev, CrowdStrike's CTO.

VentureBeat - Merritt Baer, Chief Security Officer at Enkrypt AI.

WHAT:

VentureBeat - Anthropic accidentally shipped a 59.8 MB source map file in version 2.1.88 of its @anthropic-ai/claude-code npm package.

VentureBeat - The leak exposed 512,000 lines of unobfuscated TypeScript across 1,906 files.

VentureBeat - Anthropic filed copyright takedown requests that resulted in the removal of more than 8,000 copies and adaptations from GitHub.

VentureBeat - The leaked codebase is 90% AI-generated, according to Anthropic's disclosures.

VentureBeat - GitGuardian's report found that Claude Code-assisted commits leaked secrets at a 3.2% rate.

WHERE:

VentureBeat - The leak and subsequent DMCA takedown requests occurred on GitHub.

WHEN:

VentureBeat - The source map file was shipped on March 31st, 2026.

VentureBeat - The leak was discovered by Chaofan Shou at approximately 4:23 UTC on March 31st, 2026.

VentureBeat - The Supreme Court declined to revisit the human authorship standard in March 2026.

VentureBeat - GitGuardian's State of Secrets Sprawl 2026 report was published on March 17th, 2026.

WHY:

VentureBeat - The exposure was confirmed as a packaging error caused by human error at Anthropic.

VentureBeat - The leak reflects a gap between Anthropic's product capability and operational discipline, prompting security leaders to rethink evaluations of AI development tool vendors.

HOW:

VentureBeat - The leak occurred due to a packaging error in the npm package, which included a source map file.

VentureBeat - The DMCA takedown was intended to target one specific repository but inadvertently affected more due to its connection to a fork network.

(UPDATED April 2, 2026 19:22 UTC)

Anthropic, a company focused on AI development, accidentally shipped a 59.8 MB source map file in version 2.1.88 of its @anthropic-ai/claude-code npm package on Tuesday, exposing 512,000 lines of unobfuscated TypeScript across nearly 1,900 files. The leak, discovered by security researcher Chaofan Shou, was attributed to a packaging error and led Anthropic to file copyright takedown requests that removed over 8,000 copies from GitHub. This incident has prompted security leaders to reassess their evaluations of AI development tool vendors, highlighting a gap between Anthropic's product capabilities and operational discipline.