clawsmith.com/idea/strip-source-maps-and-secrets-from-npm-packages-before-publish

IdeaCompetitiveSECURITYCLIDEVTOOLLive

A pre-publish scanner that strips source maps, secrets, and internal code from npm packages before they ship to the registry

Anthropic accidentally shipped 512K lines of Claude Code source code via an npm source map file that was never meant to be public. This happens constantly because .npmignore and package.json files fields are easy to misconfigure. The repo got 100K+ stars in days as people reversed the entire codebase. This tool scans your npm package before publish, catches source maps, leaked environment variables, internal documentation, and accidentally included files, then blocks the publish until you fix it.

Demand Breakdown

GitHub

101,000

18,899

6,500

4,100

Social Proof 5 sources

claw-code Rust rewrite hit 101K stars from the leaked source

@instructkr · 2026-03

101,000 X

Claude Code source code leaked via npm source map, 18.9K likes

@Fried_rice · 2026-03

18,899 RD

r/ClaudeAI discussion of Claude Code source leak reaches 6.5K engagement

@multiple · 2026-03

6,500 HN

HN discussion of Claude Code npm source map leak

@multiple · 2026-03

2,300 HN

Analysis reveals fake tools, frustration regexes, undercover mode in leaked code

@multiple · 2026-03

1,800

Gap Assessment

CompetitiveMultiple tools exist but differentiation opportunities remain

3 tools exist (npm-packlist, Socket.dev, Secretlint) but gaps remain: No content scanning, no secret detection, no source map analysis, just file listing; Post-publish only, no pre-publish prevention, no source map deep analysis, consumer-side not publisher-side.

Features4 agent-ready prompts

CLI that runs before npm publish, scans the package tarball for secrets (API keys, tokens, passwords), and blocks publish if found

▶

Parser that detects embedded source maps, inline source content, and webpack devtool artifacts that would expose original source code

▶

Pre-commit hook and CI action that runs the scanner automatically on every publish attempt and fails the pipeline on violations

▶

Tool that scans your already-published npm packages on the registry and reports which versions contain leaked secrets or source maps

▶

Competitive LandscapeFREE

Product	Does	Missing
npm-packlist	Lists files that npm pack would include	No content scanning, no secret detection, no source map analysis, just file listing
Socket.dev	Scans npm packages for supply chain attacks post-publish	Post-publish only, no pre-publish prevention, no source map deep analysis, consumer-side not publisher-side
Secretlint	Scans files for hardcoded secrets using pattern matching	General-purpose, not npm-publish-aware, no source map analysis, no package.json files field checking