Source Code Leak Exposes Supply Chain Vulnerabilities

Anthropic accidentally included ~2,000 internal TypeScript files in an npm package due to improper build configuration, exposing critical architectural details and hidden features. This human error created a massive security breach that attackers quickly exploited through typosquatting and supply chain attacks. The incident demonstrates how packaging mistakes can turn internal code into public intelligence for adversaries, while also creating opportunities for follow-on attacks against users who trust the compromised supply chain.

Tactical Insight

Immediate actions

Audit all published packages for unintended file inclusions and unpublish compromised versions
Scan systems that installed affected packages for indicators of compromise
Block known typosquatting domains and malicious package names

Long-term improvements

Implement automated pre-publication scanning to detect sensitive files in package builds
Establish separate build environments that exclude internal source code from public packages
Create approval workflows requiring multiple reviewers before publishing to public repositories

Detection measures

Monitor package repositories for unauthorized forks and suspicious activity around your packages
Set up alerts for new packages with names similar to your internal dependencies