Contrary to initial speculation, the recent massive code leak for Claude AI was not the work of Russian actors, nor was it an industrial espionage operation. The incident was, in fact, caused by a simple human oversight: a file was inadvertently included in an npm package.
On March 31st, during the publication of version 2.1.88 of “Claude Code” to the npm registry, Anthropic’s development teams mistakenly omitted to secure a critical file, leading to its public exposure.

