TL;DR: On March 31, 2026, Anthropic accidentally published 513,000 lines of Claude Code's TypeScript source to npm. Within hours, researchers found critical security vulnerabilities using the exposed code — and threat actors launched a malware campaign riding the hype wave. Here's everything you need to