A clear, action-focused breakdown of the March 31, 2026 Claude Code source-map leak: what was exposed, what was not, Anthropic DMCA sweep that hit their own repos, clean-room reimplementations, and the uncomfortable copyright parallels.
Axios was compromised on npm on March 31, 2026. Malicious versions 1.14.1 and 0.30.4 pulled plain-crypto-js@4.2.1, executed a postinstall dropper, and fetched a cross-platform RAT. Here is the verified timeline, impact, IOCs, and recovery plan.
Forbes surfaced the shift, but the deeper story is that agentic AI breaks static enterprise trust models. Here is how identity, delegated authority, prompt injection defense, and tool-level policy need to change in 2026.
Anthropic exposes industrial-scale IP theft by DeepSeek, Moonshot, and MiniMax—16 million exchanges, 24,000 fake accounts, and a national security threat that changes everything about AI security. This is the full forensic breakdown of the largest AI model theft operation ever documented.