<p><strong>TLDR:</strong> Anthropic accidentally shipped 512,000 lines of unobfuscated TypeScript in a Claude Code npm release via a forgotten source map file, triggering mass DMCA takedowns that caught legitimate open source forks in the crossfire. Separately, the Axios npm package was compromised for roughly three hours after a social engineering attack installed a RAT on a maintainer’s machine — no 2FA or trusted publishing would have stopped it. Linux gaming hit 5.33% Steam market share, more than double macOS. The LibreOffice governance crisis deepened as the Document Foundation removed all Collabora developers from membership in a single action.</p>
<hr>
<h2>Claude Code source leak and DMCA fallout</h2>
<p>Anthropic shipped a 59.8MB source map with Claude Code v2.1.88, exposing 512,000 lines of TypeScript across 1,900 files — not a breach, just a missing exclusion in the build config. The code revealed two unreleased background services (KAIROS, an autonomous scheduling daemon, and autoDream, a memory consolidation sub-agent), 44 hidden feature flags including a fully built Tamagotchi-style companion pet system, internal model codenames (Capybara for Claude 4.6, Fennec for Opus 4.6, and an unreleased model called Numbat), and a 2,600-line bash security system for blocking shell injection. Anthropic pulled the package and filed DMCA takedowns targeting repos with the leaked code — but GitHub’s automated process swept up forks of Anthropic’s own open source Claude Code SDK, taking down legitimate projects in the collateral damage. Anthropic retracted those notices quickly, but the episode landed badly: the company that keeps Claude Code closed source accidentally open-sourced it, then DMCA’d the community for noticing.</p>
<h2>Axios supply chain attack</h2>
<p>On March 31, two malicious versions of Axios (1.14.1 and 0.30.4) were live on npm for roughly three hours before removal. The attacker spent weeks building rapport with lead maintainer Jason Saayman under a fake company persona, eventually getting him to install a RAT via a fake video call. With the RAT running, the attacker hijacked browser sessions and used Saayman’s own credentials to publish versions injecting a remote access trojan targeting macOS, Windows, and Linux. Because the attacker operated as the maintainer, 2FA and OIDC-based trusted publishing offered no defense. North Korean threat actors (BlueNoroff/UNC1069) are suspected, and the same campaign has been confirmed targeting maintainers of Lodash, Fastify, Pino, and Undici. The strategic shift from crypto founders to npm maintainers gives attackers write access to packages downloaded trillions of times annually.</p>
<h2>Linux gaming hits record Steam share</h2>
<p>Valve’s March 2026 Steam survey shows Linux at 5.33% market share — an all-time high and more than double macOS’s 2.35%. Windows dropped 4.28 percentage points to 92.33%. The spike is partly explained by Valve correcting Steam China data, but the trend is real: SteamOS, Arch, Mint, and Ubuntu variants lead the Linux breakdown, and AMD CPUs account for nearly 70% of Linux gamers’ hardware. Separately, CachyOS benchmarks showed 3–10% FPS gains over Windows 11 in most titles, with standout wins in Space Marine 2 and Cyberpunk 2077.</p>
<h2>LibreOffice governance fractures</h2>
<p>The Document Foundation’s Membership Committee removed all Collabora staff and partners from TDF membership in a single action, affecting over 30 developers including seven of LibreOffice’s all-time top ten core committers. TDF says the removals follow newly adopted bylaws requiring anyone affiliated with a company in an active legal dispute with TDF to step down, and frames the move as the outcome of years of unresolved conflicts of interest and legally problematic board decisions. Collabora CEO Michael Meeks — a TDF co-founder — calls it electoral gerrymandering and says Collabora will refocus on a lighter Collabora Office product built from a cleaner codebase. TDF says it has been preparing for this by hiring developers and pursuing new partnerships.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Linux 7.0-rc7 released:</strong> Stable release expected April 12; includes improved security documentation aimed at AI tools submitting bug reports, a fix for a long-standing Ath11k/Ath12k WiFi throughput bug, and new XPad device IDs for the Razer Wolverine V3 Pro and Betop KP50.</li>
<li><strong>Linux 7.0 PostgreSQL regression:</strong> An AWS engineer found Linux 7.0 cuts PostgreSQL throughput roughly in half on Graviton4 hardware due to restricted kernel preemption modes; kernel maintainer Peter Zijlstra is pushing back on the proposed fix, arguing PostgreSQL should adopt RSEQ instead.</li>
<li><strong>Linux 7.1 drops i486 support:</strong> Ingo Molnar’s patch removes CONFIG_M486SX, CONFIG_M486, and CONFIG_MELAN — ending 37 years of i486 support in the kernel. Users still on that hardware should stay on an LTS kernel.</li>
<li><strong>ONLYOFFICE vs Euro-Office:</strong> Nextcloud and IONOS forked ONLYOFFICE into “Euro-Office” and stripped its logo retention requirements; ONLYOFFICE claims this violates AGPLv3 Section 7 and has suspended its 8-year Nextcloud partnership. The FSF’s published position largely supports Euro-Office’s interpretation.</li>
<li><strong>Wayland Protocols 1.48:</strong> After six years, xdg-session-management finally merged — compositors can now save and restore window states across restarts and crashes. KWin already has an early implementation.</li>
<li><strong>Archinstall 4.0:</strong> Full UI rewrite replacing curses with Textual; adds firewalld setup during install and GRUB UKI support. A follow-up 4.1 dropped the NVIDIA proprietary driver option after nvidia-dkms was removed from Arch repos.</li>
<li><strong>GNOME 50 drops Google Drive:</strong> The libgdata library that powered Nautilus Google Drive mounting went unmaintained for four years and was archived; keeping it would have meant shipping libsoup2 with open CVEs. rclone is the practical replacement for now.</li>
<li><strong>Fyrox 1.0:</strong> The Rust game engine hits stable after seven years, with a Unity-like editor, full 2D/3D support, PBR rendering, and a new animation blending state machine. MIT licensed with ~150 contributors.</li>
<li><strong>Discord open-sources Osprey:</strong> The safety rules engine processing 400 million daily actions at 2.3 million rules/second is now public — Rust coordinator, stateless Python workers, rules written in a Python-based DSL called SML.</li>
<li><strong>Internet Bug Bounty pauses payouts:</strong> The IBB, which has funded Node.js and other open source security work since 2016, stopped accepting new submissions; AI-assisted vulnerability discovery is flooding submissions faster than maintainers can remediate them. Node.js loses bounty funding.</li>
<li><strong>Gemma 4 released under Apache 2.0:</strong> Google’s most capable open model family (up to 31B parameters) ships under a proper OSI-approved license for the first time in the Gemma line.</li>
<li><strong>Fedora rejects systemd environment variable proposal:</strong> FESCo voted 6-0 against centralizing per-user environment management under systemd, citing silent breakage in containers running Fedora-based images.</li>
<li><strong>Ubuntu 26.04 raises RAM minimum to 6GB:</strong> Canonical calls it an “honesty bump” — the 4GB figure was always optimistic for a GNOME desktop with a browser open. The 6 GB number reflects what actually works day-to-day.</li>
<li><strong>OpenSSH 10.3:</strong> Security fix for late validation of metacharacters in usernames; removes bug compatibility for SSH implementations lacking rekeying support.</li>
<li><strong>Claude Code finds 23-year-old Linux kernel bug:</strong> Anthropic researcher Nicholas Carlini used Claude Code to discover heap buffer overflows in the NFS driver, including one present since 2003 — found by looping the agent over every kernel source file with a shell script.</li>
</ul>


Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

A packed week in open source and security: Anthropic accidentally shipped 512,000 lines of unobfuscated TypeScript source in a Claude Code npm release via a forgotten source map, revealing unreleased features and internal codenames, then triggered DMCA takedowns that caught legitimate open source forks. The Axios npm package was compromised for ~3 hours after a social engineering attack installed a RAT on a maintainer's machine — suspected North Korean threat actors (BlueNoroff) are targeting npm maintainers of major packages including Lodash, Fastify, and Undici. Linux gaming hit a record 5.33% Steam market share, more than double macOS. The Document Foundation removed all Collabora developers from LibreOffice membership amid a governance dispute. Also notable: Fyrox 1.0 Rust game engine stable release, Discord open-sourcing its Osprey safety rules engine, Linux 7.0 PostgreSQL throughput regression on Graviton4, GNOME 50 dropping Google Drive support, and Wayland finally merging session management after six years.

Claude Code leaks its own source, Axios supply chain attack hits npm