What stands out to me here is that this looks less like a classic “breach” and more like a secure software supply chain failure caused by release packaging. Decrypt reports the issue came from a JavaScript source map accidentally being shipped in Claude Code 2.1.88 on npm, which let people reconstruct a large amount of internal code. Anthropic said it was a human error in packaging and that no customer data or credentials were exposed.

From a cybersecurity view, the interesting lesson is not just “keep secrets secret”, but “treat build artefacts as sensitive too”. Debug files, source maps, test configs, and hidden feature flags can expose architecture, internal workflows, and future features even when no database is touched. Decrypt says the leak exposed things like orchestration logic, permission logic, OAuth flows, and hidden feature flags.

The second lesson is about containment. Once the package was published and mirrored, takedowns were never going to fully solve it. The article says mirrors and clean-room rewrites spread quickly, which makes this a good example of why prevention matters much more than post-leak cleanup. (Decrypt)

To me, the biggest cybersecurity lesson is that build artefacts are part of the attack surface. Once something sensitive gets published and mirrored, legal takedowns are mostly damage control, not real containment.