Seth Shelnutt

VP of Engineering, Coder

On March 31, the latest version of Anthropic&#39;s Claude Code shipped to the npm registry with a source map file that should have been excluded from the package. Within hours, more than 500,000 lines of proprietary source code were mirrored across GitHub, X, Reddit, and decentralized repositories. Anthropic responded quickly, confirming this was &quot;caused by human error, not a security breach,&quot; and no customer data or credentials were exposed.

The root cause was a missing exclusion rule in a build configuration file. A simple oversight in a packaging step - something any engineering team can make - turned what should have been a routine release into front-page news. The Claude Code incident was not an isolated event. It was one in a pattern that compressed months of supply chain exposure into days.

That is the reality of software supply chains in 2026: even the best teams that ship at the pace modern development demands face this risk.

<h2>A cascade, not a coincidence</h2>

The timeline is worth laying out in full, because the density matters.

First, <a href="https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23">Trivy disclosed a critical vulnerability</a> in its container scanning tool. Days later, <a href="https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise">Trivy was hit again</a> through a GitHub Actions compromise that widened the blast radius. <a href="https://docs.litellm.ai/blog/security-update-march-2026">LiteLLM was caught in the fallout</a>, issuing its own security update as a downstream dependency. Then the <a href="https://x.com/Fried_rice/status/2038894956459290963">Claude Code source map leaked</a>. Within hours, <a href="https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan">axios, one of npm&#39;s most downloaded packages, was compromised</a> with malicious versions delivering a remote access trojan. Attackers then immediately began <a href="https://x.com/Butanium_/status/2039079715823128964">squatting Anthropic&#39;s internal package names</a> on npm, targeting developers attempting to compile the leaked source.

Five distinct supply chain incidents in roughly two weeks. Each one exploited a different vector: a vulnerability scanner, a CI/CD pipeline, a dependency chain, a build configuration error, and package name squatting. The common thread is that every one of them targets the software supply chain, the layer of tooling, packages, and infrastructure that sits between your code and production.

<h2>Why the Claude Code incident matters beyond Anthropic</h2>

The specifics of the Claude Code incident illustrate how vulnerable even the most rigorous engineering organizations can be. Bun, the bundler Anthropic uses, generates source maps by default. A single missing exclusion rule in a configuration file led to one of the most significant accidental code exposures in recent AI history.

As development velocity increases and as AI agents take on more of the build and release workflow, the surface area for human oversight gaps grows with it. Every organization shipping software at scale faces some version of this risk. The question is whether a single missed configuration step can cascade into a material exposure.

The package squatting that followed the incident makes the downstream risk concrete. Attackers registered npm packages mimicking Anthropic&#39;s internal tooling, targeting developers exploring the leaked source. That is a supply chain attack built on top of an accidental exposure, and it happened within 24 hours.

<h2>The infrastructure layer is the control surface</h2>

The instinct after a wave of incidents like this is to lock things down. Restrict internet access. Block package installations. Pull AI coding agents off developer machines entirely. That approach trades one problem for another: you eliminate supply chain risk by eliminating the ability for engineers to do their work.

The alternative is to move the security perimeter from the endpoint to the infrastructure. Instead of securing every developer laptop and hoping nobody installs a compromised package, you run development workloads inside isolated environments where the blast radius is contained by design.

This is the architectural principle behind <a href="https://coder.com/solutions/workspaces?utm_campaign=26Q2_Coder_Blog_Resources&utm_source=coder&utm_medium=&utm_content=blog&utm_term=">cloud development environments</a>. When a developer or an AI agent operates inside an isolated workspace, a compromised dependency cannot reach the corporate network, exfiltrate credentials, or pivot to production systems. The workspace boundary enforces containment automatically, regardless of what runs inside it. Kubernetes, Firecracker micro-VMs, full VMs, physical hosts: the isolation mechanism is configurable, but the principle is consistent. The environment is the perimeter.

<img src="https://www.datocms-assets.com/19109/1775154597-blog-image.png" alt="">

This is not a theoretical defense model. When the <a href="https://resources.coder.com/hub/col/resource-center/shai-hulud-defending-software-supply-chain?pflpid=60798&pfsid=HKhWcljba2?utm_campaign=26Q2_Coder_Blog_Resources&utm_source=coder&utm_medium=&utm_content=blog&utm_term=">Shai-Hulud 2.0 supply chain attack</a> compromised hundreds of npm packages and over 25,000 GitHub repositories in late 2025, the organizations that recovered fastest were the ones that had already separated developer environments from developer endpoints. They could rebuild, rotate credentials, and resume work in hours while others spent weeks auditing distributed machines. The same architectural controls that contained Shai-Hulud apply directly to the incidents unfolding this week.

Centralized tooling management addresses the Claude Code scenario directly. When <a href="https://coder.com/docs/admin/templates?utm_campaign=26Q2_Coder_Blog_Resources&utm_source=coder&utm_medium=&utm_content=blog&utm_term=">workspace templates</a> define which versions of AI tools ship pre-installed and verified, developers do not need to pull agents from registries themselves. Environment configuration becomes code, not a policy document that relies on human compliance.

Network boundaries add the final layer. The axios compromise and the package squatting incidents both depend on malicious code phoning home, which requires outbound network access. 

<a href="https://coder.com/docs/ai-coder/ai-governance?utm_campaign=26Q2_Coder_Blog_Resources&utm_source=coder&utm_medium=&utm_content=blog&utm_term=">AI Governance</a> enforces network isolation at the process level, and workspace-level network controls provide additional defense. Administrators define exactly which domains an agent can reach; everything else is blocked by default. Instead of giving agents unrestricted internet access, you route model traffic through a controlled gateway and restrict all other outbound communication. The exfiltration path is closed.

<h2>What this week should change about your security posture</h2>

The pattern from the past two weeks is not going away. Supply chain attacks are increasing in frequency and sophistication, because the economics favor attackers: compromise one widely-used package, and you reach thousands of organizations simultaneously. AI coding agents amplify this dynamic.

The organizations that weather this well will be the ones that treat their development environment as a governed infrastructure layer, not as a collection of individual machines running whatever tools each developer prefers. By combining Isolated workspaces, centralized tooling management, and network boundaries they can safely scale AI.

The response to a week like this one should not be pulling AI tools away from your engineering team. It should be putting the infrastructure in place to run them safely. <a href="https://coder.com?utm_campaign=26Q2_Coder_Blog_Resources&utm_source=coder&utm_medium=&utm_content=blog&utm_term=">Start with Coder&#39;s approach to secure AI development infrastructure</a>.

A single misconfigured build file exposed 512,000 lines of Claude Code source. Here's what the recent wave of supply chain attacks means for your security posture.

AI-native Development

Secure Environments for 2,500+ Developers

Seth Shelnutt

Explore the latest from Seth

What the Claude Code Leak Tells Us About Supply Chain Security

Related content

Using Claude Code with Coder Workspaces

Introducing Coder Agents

Self-Hosted Doesn’t Always Mean What It Implies