Understand the reported Claude Code leak without confusing its scope

Identify the claims and the affected material

The 1 April video reports that Claude Code source appeared on a public NPM registry, describing 512,000 lines and 1,900 files and calling this a second leak within five days. Those figures and incident details are claims in the published description, not independently verified findings from this guide.

1. Write down what the account says was exposed and distinguish application source, user information, credentials and model weights. Leave a category unresolved when the supplied account does not establish its contents.
2. Keep the reported discovery by an intern at 4am attached to the incident narrative. Use it as context rather than proof of the impact on a particular installation or account.

Separate internal-feature interpretations from available capabilities

The description names KAIROS and hidden features, followed by a chapter about alleged decoys. A name or code path described in a leak story is not evidence that an ordinary user can enable a supported feature. The published discussion and a released product capability are different sources of information.

1. List each feature claim beside the type of evidence the video describes. Distinguish an internal name, a proposed behaviour and an actually released user-facing function.
2. Compare the explanation’s conclusion with the evidence it presents. Record uncertainty about intent or functionality rather than treating speculation about decoys as confirmed product documentation.

Evaluate the wider security and business discussion

The timeline moves to an Axios supply-chain attack at 4:49 and business fallout at 5:47. Keep these as separate subjects unless the account supplies evidence linking them. The source’s final description marker, 7:53, lies beyond the supplied 7:40 duration and is omitted from the chapter navigation.

1. For your own project, identify whether it uses the named package or tooling and inspect your dependency record through authorised sources. Keep that assessment separate from collecting or running leaked material.
2. Summarise which concerns relate to your actual setup, which are business opinions and which remain unanswered. Use official incident information for any account or software changes rather than extrapolating from a headline.

The takeaway

Assess the reported exposure by what it establishes about your own setup. A leak narrative, unreleased-feature interpretation and supply-chain incident require separate evidence.