Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

21–30 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#21
post #9

The code looks, at a glance, as bad as you expect.

Can you give an example? Looks fairly decent to me

  1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too.
  2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs.
  3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#22
post #19

Would be interesting to run this through Malus [1] or literally just Claude Code and get open source Claude Code out of it. I jest, but in a world where these models have been trained on gigatons of open source I don't even see the moral problem. IANAL, don't actually do this. https://malus.sh/

The problem is the oauth and their stance on bypassing that. You'd want to use your subscription, and they probably can detect that and ban users. They hold all the power there.

You'd be playing cat and mouse like yt-dlp, but there's probably more value to this code than just a temporary way to milk claude subscriptions.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#23
post #19

Would be interesting to run this through Malus [1] or literally just Claude Code and get open source Claude Code out of it. I jest, but in a world where these models have been trained on gigatons of open source I don't even see the moral problem. IANAL, don't actually do this. https://malus.sh/

The problem is the oauth and their stance on bypassing that. You'd want to use your subscription, and they probably can detect that and ban users. They hold all the power there.

Just use one of the distilled claude clones instead https://x.com/0xsero/status/2038021723719688266?s=46

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#26

Earlier quoted context omitted.

Can you give an example? Looks fairly decent to me

the "useCanUseTool.tsx" hook, is definitely something I would hate seeing in any code base I come across. It's extremely nested, it's basically an if statement soup `useTypeahead.tsx` is even worse, extremely nested, a ton of "if else" statements, I doubt you'd look at it and think this is sane code

useCanUseTool.tsx looks special, maybe it'scodegen'ed or copy 'n pasted? `_c` as an import name, no comments, use of promises instead of async function. Or maybe it's just bad vibing...

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#27
post #21

Earlier quoted context omitted.

Can you give an example? Looks fairly decent to me

1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too. 2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs. 3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.

You're right about process.argv - wow, that looks like a maintenance and testability nightmare.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#28

Earlier quoted context omitted.

the "useCanUseTool.tsx" hook, is definitely something I would hate seeing in any code base I come across. It's extremely nested, it's basically an if statement soup `useTypeahead.tsx` is even worse, extremely nested, a ton of "if else" statements, I doubt you'd look at it and think this is sane code

useCanUseTool.tsx looks special, maybe it'scodegen'ed or copy 'n pasted? `_c` as an import name, no comments, use of promises instead of async function. Or maybe it's just bad vibing...

Maybe, I do suspect _some_ parts are codegen or source map artifacts.

But if you take a look at the other file, for example `useTypeahead` you'd see, even if there are a few code-gen / source-map artifacts, you still see the core logic, and behavior, is just a big bowl of soup

Post reply on HN