Claude Code Source Map Leak Exposes 500,000 Lines of Code as Arm Confirms Breach

An exposed source map file in the Claude Code npm package leaked between roughly 500,000 and 513,000 lines of source code across nearly 2,000 files, according to updated technical reporting on the incident. Separately, chip design giant Arm has confirmed a breach attributed to a threat actor tracked as D1R, while ServiceNow disclosed a security incident involving an unauthenticated API endpoint that exposed customer instance data across multiple organizations.

How a Source Map Exposed Half a Million Lines of Code

The incident traces to a source map file bundled with the Claude Code npm package, a type of file normally used to help developers debug minified or compiled JavaScript by mapping it back to readable source code. When source maps are inadvertently published alongside production code, they can expose the underlying, human-readable source that the minification process was specifically intended to obscure, precisely what happened in this case.

Several details about this specific incident matter for understanding its actual severity:

• No customer data or credentials were reportedly exposed — the leak involved source code rather than user data, meaning the direct privacy and account-security impact for Claude Code users appears limited based on current reporting
• Rapid replication increases exposure risk — copies of the exposed code spread quickly across GitHub once discovered, meaning containment after initial discovery became effectively impossible, a common pattern once source code reaches public code-sharing platforms
• Competitive and security review risk remains real — even without direct customer data exposure, source code exposure of this scale can reveal implementation details, internal architecture decisions, and potentially security-relevant logic that would not otherwise be public

This incident is a useful, if uncomfortable, reminder that source map exposure remains a persistent and frequently underestimated risk across the software industry broadly, affecting sophisticated AI companies just as readily as any other software vendor, and organizations publishing npm packages of any kind should specifically verify source maps are excluded from production package builds as a standard release checklist item.

Arm Confirms a Breach From Threat Actor D1R

Arm, the UK-based semiconductor design company whose chip architectures underpin the vast majority of the world’s mobile devices and an increasing share of AI and embedded computing hardware, has been confirmed as a breach victim by a threat actor tracked as D1R. Given Arm’s foundational role in global chip design licensing, spanning smartphones, IoT devices, and increasingly AI accelerator designs, a breach of this significance carries potential downstream implications extending well beyond Arm’s own corporate systems, depending on what specific data or intellectual property the attacker actually obtained.

ServiceNow’s API Flaw Exposed Data Across Customer Instances

ServiceNow disclosed a security incident in which attackers exploited an unauthenticated access flaw in a vulnerable API endpoint used by hosted customer instances, with malicious activity reportedly beginning June 2 and bug bounty reports flagging the issue by June 3 and 4. ServiceNow applied a security update to hosted customer instances by June 5, changed the affected endpoint configuration, and directly notified customers where evidence showed successful data queries had occurred.

Given how broadly ServiceNow instances are used to store internal tickets, employee records, asset data, workflow records, and operational documentation across enterprise customers, the specific exposure risk for any individual organization depends heavily on what data their particular instance contained and whether the attacker’s queries successfully reached it before the fix was deployed. Organizations using ServiceNow should confirm with their security team whether they received direct notification from ServiceNow regarding this specific incident and, if so, what data was confirmed accessed.

A Notarized macOS Stealer Slips Past Apple’s Own Vetting

Researchers at Jamf Threat Labs have identified a new macOS information stealer called CrashStealer, notable specifically because it is distributed through a signed and Apple-notarized dropper, meaning it carries a valid Apple developer ID and passed Apple’s own notarization security review process. Written in native C++ rather than the more common AppleScript or Objective-C wrapper approaches, CrashStealer validates a victim’s login password locally before harvesting data broadly across browsers, cryptocurrency wallets, password managers, and the system keychain, then encrypts everything collected before exfiltrating it.

The fact that this malware successfully obtained Apple notarization is genuinely concerning, since notarization exists specifically to give users confidence that downloaded software has passed Apple’s security screening. Mac users should not assume notarization alone guarantees software safety, particularly for applications distributed outside the official Mac App Store.

Joomla Extensions Face Active Exploitation

CISA is warning that attackers are actively exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. Organizations running Joomla with either of these extensions installed should treat this as an urgent patching priority given CISA’s specific active-exploitation warning.

A Wave of Ransomware Victims Hits Diverse Sectors

Fresh ransomware disclosure data from this week alone shows victims spanning an Australian equipment supply company hit by DragonForce, a Saudi trading firm also targeted by DragonForce, a Spanish industrial supplies distributor hit by DeadLock, a US home services company targeted by Qilin, and a French luxury skincare brand hit by The Gentlemen. This breadth of targeting, spanning industrial equipment, home services, and luxury consumer goods across at least four different countries within a single day’s disclosures, illustrates just how indiscriminately ransomware groups continue casting their net across sectors and geographies.

What Organizations Should Do Now

Given the Claude Code source map exposure, development teams publishing npm packages of any kind should audit their release pipelines specifically to confirm source maps are excluded from production builds. Organizations using ServiceNow should directly confirm with their account team whether they were affected by the June API endpoint vulnerability and what data exposure, if any, was identified. Mac-focused security teams should update endpoint detection signatures to account for CrashStealer’s notarized distribution method, since traditional “trust notarized software” heuristics will not catch this specific threat. And any organization running Joomla with the iCagenda or Balbooa Forms extensions should patch immediately given CISA’s active exploitation warning.

This week’s cybersecurity landscape spans an uncomfortable reminder that even sophisticated AI companies can fall victim to basic source map exposure mistakes, a breach at one of the world’s most foundational chip design companies, and malware that successfully passed Apple’s own security vetting. No organization, regardless of technical sophistication, is immune from the kind of routine security missteps that continue driving the majority of breaches disclosed each week.

---

Published by MAJ.COM AI Autonomous
Email: Support@MAJ.COM
Website: https://QUE.COM Intelligence | Sponsored by https://MAJ.COM Automate Your Business. Multiple Your Revenue.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous