Anthropic Accidentally Leaks Claude Code's Entire Source Code via npm | AILinks

🔗 View in your browser | ✍️ Publish on FAUN.dev | 🦄 Become a sponsor

AILinks

This week in Generative AI/ML, with Kala the Koala

📝 A Few Words

Anthropic built an entire system called "Undercover Mode" to prevent AI leaks.

Then someone forgot to add *.map to .npmignore.

512,000 lines of Claude Code's internal source just shipped to npm by accident. Here's what we can find inside:

A stealth mode that hides AI involvement in public repos (no off switch)
Next-gen model codenames encoded character-by-character to dodge their own scanner
A function called classifyYoloAction() that lets AI skip human review
Env vars that disable ALL safety features
A full Tamagotchi pet system with 18 species
An autonomous background agent that "dreams" while you sleep
22 private Anthropic repo names exposed
Hardcoded pricing: 6x markup for "Fast Mode" on the same model

This is Anthropic's second leak in five days.

Have a great week,
Aymen

🔍 Inside this Issue

AI tooling is getting powerful enough to run whole workflows, but it is also getting leaky enough to remind everyone why supply chain hygiene still matters. This set swings from accidental source exposure and agent setups, to RAG lessons learned and the unglamorous work of making context and caching actually behave.

🧯 Anthropic Accidentally Leaks Claude Code's Entire Source Code via npm
🧱 From zero to a RAG system: successes and failures
🧠 Our most intelligent open models, built from Gemini 3 research and technology to maximize intelligence-per-parameter
🧰 Qwen3.6-Plus: Towards Real World Agents
🧭 State of Context Engineering in 2026
🛠️ Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA
🌐 Why we're rethinking cache for the AI era

Steal the patterns, dodge the footguns, ship the boring fixes.

Take care!
FAUN.dev() Team

⭐ Patrons

faun.dev

Learn Git in a Day: From Zero to Real-World Workflows

Most developers pick up Git by copying commands from the internet and hoping for the best. It works, until it doesn't. One messy merge conflict or a detached HEAD, and suddenly you're stuck with no idea what went wrong or how to fix it.

This course takes a different approach. Instead of handing you a list of commands to memorize, it builds your understanding from the ground up - how Git actually thinks about your files, your history, and your changes.

You'll go from "what's a commit?" to confidently branching, merging, resolving conflicts, collaborating with a team, and keeping a clean project history.

No prior Git experience needed. Just basic comfort with a terminal and you're good to go. By the end of the day, you won't just know the commands - you'll understand why they work, and you'll be able to think your way through problems you've never seen before.

Stop guessing and start understanding how git works.

Enroll now and learn Git the right way

👉 Spread the word and help developers find you by promoting your projects on FAUN. Get in touch for more information.

🐾 From FAUNers

faun.dev

Anthropic Accidentally Leaks Claude Code's Entire Source Code via npm

Anthropic shipped a source map file inside the latest npm release of Claude Code - and with it, the full source code of its flagship AI coding CLI. The leak exposed 512,000 lines of TypeScript across 1,900 files, 43 built-in tools, 44 feature flags, 26 hidden slash commands, and over 120 secret environment variables. It is one of the most detailed accidental exposures of a commercial AI product's internals to date.

👉 Got something to share? Create your FAUN Page and start publishing your blog posts, tools, and updates. Grow your audience, and get discovered by the developer community.

🔗 Stories, Tutorials & Articles

blog.cloudflare.com

Why we're rethinking cache for the AI era

Cloudflare data shows that 32% of network traffic originates from automated traffic, including AI assistants fetching data for responses. AI bots often issue high-volume requests and access rarely visited content, impacting cache efficiency. Cloudflare researchers propose AI-aware caching algorithms and a new cache layer to address the impact of AI traffic on CDN cache.

x.com

Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA

CTO at ZAR shares his experience managing 10 engineers, shipping code, and operating at the C-level with an AI assistant named Claude Code. The system allows him to maintain context across multiple workstreams, automate tasks, and scale his productivity. In just three weeks, he has documented 82 meeting notes, held 47 meetings, and captured 11,579 lines of institutional knowledge.

newsletter.swirlai.com

State of Context Engineering in 2026

Context engineering has evolved in the AI engineering field since mid-2025 with the introduction of patterns for managing context effectively. These patterns include progressive disclosure, compression, routing, retrieval strategies, and tool management, each addressing a different dimension of the context engineering problem. The discipline of context engineering involves finding the smallest possible set of high-signal tokens to maximize the likelihood of desired outcomes within an AI system.

qwen.ai

Qwen3.6-Plus: Towards Real World Agents

Qwen3.6-Plus, the latest release following Qwen3.5 series, offers enhanced agentic coding capabilities and sharper multimodal reasoning. The model excels in frontend web development and complex problem-solving, setting a new standard in the developer ecosystem. Qwen3.6-Plus is available via Alibaba Cloud Model Studio with a 1M context window by default and improved agentic coding capability.

deepmind.google

Our most intelligent open models, built from Gemini 3 research and technology to maximize intelligence-per-parameter

Built from Gemini 3 research and technology, Gemma 4 offers maximum compute and memory efficiency for mobile and IoT devices. Develop autonomous agents, multimodal applications, and multilingual experiences with Gemma 4's unprecedented intelligence-per-parameter.

en.andros.dev

From zero to a RAG system: successes and failures

An engineer spun up an internal chat with a local LLaMA model via Ollama, a Python Flask API, and a Streamlit frontend.

They moved off in-memory LlamaIndex to batch ingestion into ChromaDB (SQLite). Checkpoints and tolerant parsing went in to stop RAM disasters.

Indexing produced 738,470 vectors (~54 GB). They rented an NVIDIA RTX 4000 VM for embeddings and pushed originals to Azure Blob via SAS links.

👉 Got something to share? Create your FAUN Page and start publishing your blog posts, tools, and updates. Grow your audience, and get discovered by the developer community.

⚙️ Tools, Apps & Software

github.com

garrytan/gstack

Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA

github.com

samber/cc-skills-golang

🧑‍🎨 A collection of Golang agentic skills that works - samber/cc-skills-golang

github.com

ultraworkers/claw-code-parity

claw-code Rust port parity work - it is temporary work while claw-code repo is doing migration

github.com

google-research/timesfm

TimesFM (Time Series Foundation Model) is a pretrained time-series foundation model developed by Google Research for time-series forecasting.

github.com

itigges22/ATLAS

Adaptive Test-time Learning and Autonomous Specialization

👉 Spread the word and help developers find and follow your Open Source project by promoting it on FAUN. Get in touch for more information.

🤔 Did you know?

Did you know that PyTorch officially deprecated TorchScript in version 2.10 because its compiler could never fully keep up with Python eager-mode semantics? For years, production teams quietly sidestepped it by serving eager models through TorchServe or exporting to ONNX Runtime, trading theoretical compiler speed for fewer graph-compatibility surprises when models with dynamic control flow or custom ops changed weekly. The replacement, torch.export, still requires code rewrites for data-dependent control flow and unsupported operators, which is why many serving stacks continue to lean on the "less optimized" eager path for reliability.

🤖 Once, SenseiOne Said

"Your model isn't in production when it hits 99% offline; it's in production when a schema change, a retry storm, and a bad deploy happen and it still behaves. MLOps is the discipline of treating accuracy as the least interesting metric you ship."

— SenseiOne

(*) SenseiOne is FAUN.dev’s work-in-progress AI agent

⚡Growth Notes

Engineers who wrap every LLM call in a retry loop with temperature jitter as a poor man's fallback strategy rarely notice that they are training their system to treat nondeterminism as resilience. The deeper problem surfaces when you need to reproduce a failure in production: your logs show five attempts, each with different sampling parameters, and none of them match the output the user actually saw.

Each week, we share a practical move to grow faster and work smarter

😂 Meme of the week

❤️ Thanks for reading

👋 Keep in touch and follow us on social media:
- 💼LinkedIn
- 📝Medium
- 🐦Twitter
- 👥Facebook
- 📰Reddit
- 📸Instagram

👌 Was this newsletter helpful?
We'd really appreciate it if you could forward it to your friends!

🙏 Never miss an issue!
To receive our future emails in your inbox, don't forget to add community@faun.dev to your contacts.

🤩 Want to sponsor our newsletter?
Reach out to us at sponsors@faun.dev and we'll get back to you as soon as possible.

AILinks #523: Anthropic Accidentally Leaks Claude Code's Entire Source Code via npm
Legend: ✅ = Editor's Choice / ♻️ = Old but Gold / ⭐ = Promoted / 🔰 = Beginner Friendly

You received this email because you are subscribed to FAUN.dev.
We (🐾) help developers (👣) learn and grow by keeping them up with what matters.

You can manage your subscription options here (recommended) or use the old way here (legacy). If you have any problem, read this or reply to this email.