Obfuscation is not security – AI can deobfuscate any minified JavaScript code

It's April 1st, but this post is not a joke.

The internet is on fire over Claude Code's (NPM CLI to be precise) "leaked" source. 512,000 lines! Feature flags! System prompts! Unreleased features! VentureBeat, Fortune, Gizmodo, The Register, Hacker News — everyone covered it. A clean-room Rust rewrite (to dodge the DMCA) hit 100K GitHub stars in nearly a day — a world record. 110K now and counting.

Here's what nobody's saying: all of that was already public! On npm. In plaintext. For years. Open unpkg.com/@anthropic-ai/claude-code/cli.js right now — that's the entire Claude Code CLI, one click away, readable in your browser. No leak required.

What "leaked" was a source map file that added internal developer comments on top of code that was never protected in the first place, plus a directory/source structure.

What Actually Happened

A .map source map file — meant for internal debugging — was accidentally included in version 2.1.88 of the @anthropic-ai/claude-code package on npm. Security researcher Chaofan Shou spotted it, posted on X, and the internet did the rest.

Anthropic confirmed the mistake: "This was a release packaging issue caused by human error, not a security breach." The package was pulled, but by then it had already been mirrored everywhere.

The funny part? This is the second time. A nearly identical source map leak happened in February 2025. Same product, same mistake, thirteen months apart.

The Internet Lost Its Mind — In One Day

What happened next was genuinely impressive. In a single day:

• Code dumps appeared on GitHub — like nirholas/claude-code, which was DMCA'd by Anthropic within hours but not before being forked hundreds of times.
• Claw Code — a full Rust rewrite of the Claude Code architecture — hit 50,000 GitHub stars in 2 hours, making it the fastest repo in history to reach that milestone. It's now being actively developed as an open-source AI coding agent framework.
• ccleaks.com popped up — a fully designed breakdown site cataloging every unreleased feature, hidden command, and build flag found in the source. Complete with shareable cards for discoveries like "BUDDY" (an AI companion pet), "ULTRAPLAN" (30-minute remote planning mode), and 44 other feature flags.

But the Code Was Already There

Here's what most of the coverage missed: Claude Code ships as a single bundled JavaScript file — cli.js — distributed via npm. It's 13MB, 16,824 lines of JavaScript. And it's been sitting there, publicly accessible, since the product launched.

We analyzed this file at AfterPack as part of a deobfuscation case study. What we found: it's minified, not obfuscated.

Minification — what every bundler (esbuild, Webpack, Rollup) does by default — shortens variable names and removes whitespace. It makes code smaller for shipping. It was never designed to hide anything. Obfuscation is designed to make reverse engineering computationally expensive. Claude Code has the first. Zero of the second.

All 148,000+ string literals sit in plaintext. Every system prompt, every tool description, every behavioral instruction — right there in the JavaScript, readable with a text editor. No source maps needed.

We Asked Claude to Deobfuscate Itself

Here's where it gets interesting. We didn't need source maps to extract Claude Code's internals. We asked Claude — Anthropic's own model — to analyze and deobfuscate the minified cli.js file. It worked. Extremely well.

Using a simple AST-based extraction script, we parsed the full 13MB file in 1.47 seconds and extracted 147,992 strings. After categorizing them:

• 1,017 system prompts and instructions
• 431 tool descriptions
• 837 unique telemetry event names
• 504 environment variables controlling the product's behavior
• Hardcoded endpoints, OAuth URLs, and API keys.

LLMs are shockingly good at deobfuscation, transpilation, and structure-to-structure conversions. The source maps didn't reveal the code. The code was already revealed. Source maps just added comments and a source tree structure on top.

This Happens More Than You Think

This isn't an Anthropic-specific problem. It's an industry-wide accepted practice. We ran scanners on GitHub's own website and found email addresses, environment variable names, and internal URLs all sitting in production JavaScript and source maps, publicly accessible.

AI Makes This Urgent

Minification was never security. It's a size optimization. Variable renaming that slows down human readers is trivial for LLMs. If you ship it to the browser, AI can read it.